MiReplaceRotateWithDemandZero

NTSTATUS __stdcall MiReplaceRotateWithDemandZero(
        VOID *VirtualAddress,
        VOID *LastVa,
        _MI_PFN_CACHE_ATTRIBUTE CacheAttribute){
  char *v5; 
  unsigned int v6; 
  __int64 v7; 
  _EPROCESS *Process; 
  _MMPTE *PteBase; 
  _MMPTE *v10; 
  unsigned __int64 *v11; 
  _MMSUPPORT_INSTANCE *p_Instance; 
  CHAR v13; 
  char v14; 
  __int64 v15; 
  unsigned int v16; 
  __int64 v17; 
  __int64 v18; 
  UINT64 v19; 
  int v20; 
  __int64 *v21; 
  unsigned __int64 v22; 
  _MMPFN *v23; 
  UINT64 v24; 
  char WsIrql; 
  unsigned int WsIrql_4; 
  _MI_PFN_CACHE_ATTRIBUTE CacheAttributea[2]; 
  UINT64 IoPageFrame; 
  unsigned __int64 v30; 
  _MMSUPPORT_INSTANCE *v31; 
  __int64 v32; 
  _MI_TB_FLUSH_LIST TbFlushList[48]; 
  __int64 v34[44]; 

  CacheAttributea[0] = CacheAttribute;
  v5 = 0i64;
  IoPageFrame = 0i64;
  memset(TbFlushList, 0i64, 0xB8u);
  v6 = 0;
  WsIrql_4 = 0;
  v7 = 0i64;
  Process = KeGetCurrentThread()->ApcState.Process;
  PteBase = MmGetPteBase();
  v10 = (_MMPTE *)((char *)PteBase + (((unsigned __int64)VirtualAddress >> 9) & 0x7FFFFFFFF8i64));
  v30 = (unsigned __int64)PteBase + (((unsigned __int64)LastVa >> 9) & 0x7FFFFFFFF8i64);
  v11 = (unsigned __int64 *)((char *)&PteBase->u.Long + (((unsigned __int64)v10 >> 9) & 0x7FFFFFFFF8i64));
  LOWORD(TbFlushList[1]) = 0;
  p_Instance = &Process->Vm.Instance;
  *(_QWORD *)&TbFlushList[4] = 0i64;
  TbFlushList[2] = 20;
  TbFlushList[0] = 1;
  *(_QWORD *)&TbFlushList[6] = 0i64;
  v31 = p_Instance;
  MiLockWorkingSetShared();
  WsIrql = v14;
  if( (unsigned __int64)v10 <= v30 )
  {
    v15 = (_QWORD)MmGetPteBase() << 25;
    v32 = v15;
    while( 1 )
    {
      if( !v5 )
        goto LABEL_29;
      if( ((unsigned __int16)v10 & 0xFFF) == 0 )
        break;
LABEL_5:
      if( !v6 )
      {
        MiIsProbeActive(v10, 1ui64, 3i64, v13);
        v6 = v16;
      }
      if( MiUnmapFrameBuffer((ULONG_PTR)v10, CacheAttributea[0], v6, &IoPageFrame) )
        v6 = 1;
      if( IoPageFrame != -1i64 )
      {
        if( (_DWORD)v7
          && (v17 = 2i64 * (unsigned int)(v7 - 1), v18 = v34[2 * (unsigned int)(v7 - 1) + 1], v18 == IoPageFrame) )
        {
          v19 = v18 + 1;
        }
        else
        {
          v19 = IoPageFrame + 1;
          v17 = 2i64 * (unsigned int)v7;
          v7 = (unsigned int)(v7 + 1);
          v34[v17] = IoPageFrame;
        }
        v34[v17 + 1] = v19;
      }
      MiInsertTbFlushEntry(TbFlushList, (VOID *)((((_QWORD)v10 << 25) - v15) >> 16), 1ui64, 0i64);
      ++WsIrql_4;
      if( ((unsigned __int16)++v10 & 0xFFF) != 0 && (unsigned __int64)v10 <= v30 && (_DWORD)v7 != 22 )
      {
        if( ((unsigned __int8)v10 & 0x78) != 0 )
          continue;
        LOBYTE(v20) = MiWorkingSetIsContended((INT64)p_Instance);
        if( !v20
          && !(unsigned int)MiPageTableLockIsContended((__int64)p_Instance, (UINT64)v5)
          && !(unsigned int)KeShouldYieldProcessor() )
        {
          continue;
        }
      }
      MiFlushTbList(TbFlushList);
      if( (_DWORD)v7 )
      {
        v21 = v34;
        do
        {
          MiDereferenceIoPages(1i64, *v21, v21[1] - *v21);
          v21 += 2;
          --v7;
        }
        while( v7 );
        p_Instance = v31;
        v15 = v32;
      }
      v22 = *v11;
      MiPteInShadowRange((UINT64)v11);
      v23 = &MmGetPfnDb()[(v22 >> 12) & 0xFFFFFFFFFi64];
      CacheAttributea[1] = MiNonCached;
      while( _interlockedbittestandset64((volatile signed __int32 *)&v23->u2, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx((UINT64 *)&CacheAttributea[1]);
        while( v23->u2._bf_0 < 0 );
      }
      v23->u2._bf_0 ^= (v23->u2._bf_0 ^ (v23->u2._bf_0 - WsIrql_4)) & 0x3FFFFFFFFFFFFFFFi64;
      _InterlockedAnd64(&v23->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
      MiUnlockPageTableInternal((INT64)p_Instance, (UINT64)v5);
      LOBYTE(v24) = WsIrql;
      MiUnlockWorkingSetShared(p_Instance, v24);
      if( (unsigned __int64)v10 > v30 )
        return v6;
      v7 = 0i64;
      v11 = (unsigned __int64 *)((char *)&MmGetPteBase()->u.Long + (((unsigned __int64)v10 >> 9) & 0x7FFFFFFFF8i64));
      WsIrql_4 = 0;
      v5 = 0i64;
      MiLockWorkingSetShared();
    }
    MiUnlockPageTableInternal((INT64)p_Instance, (UINT64)v5);
LABEL_29:
    v5 = (char *)MmGetPteBase() + (((unsigned __int64)v10 >> 9) & 0x7FFFFFFFF8i64);
    MiLockPageTableInternal((INT64)p_Instance, (UINT64)v5, 0i64);
    goto LABEL_5;
  }
  return v6;
}

Referenced by: