MmManageFaultRange

NTSTATUS __stdcall MmManageFaultRange(PVOID BugCheckParameter3, PVOID BugCheckParameter4){
  char v2; 
  char v3; 
  _RTL_BALANCED_NODE *v4; 
  char v5; 
  int v8; 
  unsigned int v9; 
  volatile signed __int64 *v10; 
  _RTL_BALANCED_NODE *v11; 
  _RTL_BALANCED_NODE *Pool; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  UINT64 *v15; 
  unsigned __int8 v16; 
  _QWORD *v17; 
  unsigned __int64 v18; 
  BOOL v19; 
  _QWORD *v20; 
  __int64 v21; 
  __int128 v23; 
  __int128 v24; 
  __int64 v25; 

  v4 = (_RTL_BALANCED_NODE *)((char *)BugCheckParameter4 + (_QWORD)BugCheckParameter3 - 1);
  v5 = v2;
  v23 = 0i64;
  v24 = 0i64;
  v25 = 0i64;
  v8 = v3 & 1;
  if( (v3 & 1) != 0 )
  {
    v9 = 0;
    v10 = (volatile signed __int64 *)&unk_140C4C660;
    while( 1 )
    {
      v11 = (_RTL_BALANCED_NODE *)(v10 - 3);
      if( !*v10 && !_InterlockedCompareExchange64(v10, (signed __int64)BugCheckParameter3, 0i64) )
        break;
      ++v9;
      v10 += 5;
      if( v9 >= 2 )
        goto LABEL_5;
    }
    v11[1].Children[1] = v4;
LABEL_5:
    if( v9 == 2 )
    {
      Pool = (_RTL_BALANCED_NODE *)MiAllocatePool(64i64, 0x28ui64, 0x7641694Dui64);
      v11 = Pool;
      if( !Pool )
        return(int)Pool;
      Pool[1].Children[0] = (_RTL_BALANCED_NODE *)BugCheckParameter3;
      Pool[1].Children[1] = v4;
    }
  }
  else
  {
    *((_QWORD *)&v24 + 1) = BugCheckParameter3;
    v11 = (_RTL_BALANCED_NODE *)&v23;
    v25 = (__int64)BugCheckParameter4 + (_QWORD)BugCheckParameter3 - 1;
  }
  if( (v5 & 0x20) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    Process = CurrentThread->Tcb.ApcState.Process;
    if( (Process->Flags & 0x10000) == 0 )
      KeBugCheckEx(0x1Au, (PVOID)0x5230, CurrentThread->Tcb.ApcState.Process, BugCheckParameter3, BugCheckParameter4);
    v15 = (UINT64 *)((char *)Process->Session + 1008);
  }
  else
  {
    v15 = (UINT64 *)&unk_140C4C640;
  }
  v16 = ExAcquireSpinLockExclusive(&qword_140C4C638);
  v17 = (_QWORD *)*v15;
  v18 = v16;
  if( !v8 )
  {
    while( v17 )
    {
      if( v11[1].Children[0] > (_RTL_BALANCED_NODE *)v17[4] )
      {
        v17 = (_QWORD *)v17[1];
      }
      else
      {
        if( v11[1].Children[1] >= (_RTL_BALANCED_NODE *)v17[3] )
          break;
        v17 = (_QWORD *)*v17;
      }
    }
    if( (PVOID)v17[3] != BugCheckParameter3 || (_RTL_BALANCED_NODE *)v17[4] != v4 )
      KeBugCheckEx(0x1Au, (PVOID)0x5231, v17, BugCheckParameter3, BugCheckParameter4);
    RtlAvlRemoveNode(v15, v17);
    goto LABEL_18;
  }
  v19 = 0;
  if( !v17 )
    goto LABEL_17;
  while( v11[1].Children[0] <= (_RTL_BALANCED_NODE *)v17[4] && v11[1].Children[1] < (_RTL_BALANCED_NODE *)v17[3] )
  {
    v20 = (_QWORD *)*v17;
    if( !*v17 )
      goto LABEL_17;
LABEL_21:
    v17 = v20;
  }
  v20 = (_QWORD *)v17[1];
  if( v20 )
    goto LABEL_21;
  v19 = 1;
LABEL_17:
  RtlAvlInsertNodeEx((_RTL_BALANCED_NODE **)v15, (UINT64)v17, v19, v11);
  v17 = 0i64;
LABEL_18:
  ExReleaseSpinLockExclusiveFromDpcLevel(&qword_140C4C638);
  __writecr8(v18);
  if( v17 )
  {
    v21 = 0i64;
    while( v17 != (_QWORD *)((char *)&unk_140C4C648 + 40 * v21) )
    {
      v21 = (unsigned int)(v21 + 1);
      if( (unsigned int)v21 >= 2 )
        goto LABEL_25;
    }
    v17 = 0i64;
LABEL_25:
    if( v17 )
      ExFreePoolWithTag(v17, 0);
  }
  LODWORD(Pool) = 1;
  return(int)Pool;
}

Referenced by: