MiJumpStackTarget

VOID __stdcall MiJumpStackTarget(VOID *Parameter){
  _QWORD *v2; 
  __int64 v3; 
  signed __int32 v4; 
  unsigned int v5; 
  _MMPFN *PfnDb; 
  _MMPFN *v7; 
  _MMSUPPORT_INSTANCE *v8; 
  _MMPFN *v9; 
  __int64 v10; 
  UINT16 v11; 
  UINT64 PteBase; 
  char v13; 
  _LIST_ENTRY *Blink; 
  unsigned int v15; 
  unsigned __int64 *v16; 
  unsigned __int64 Long; 
  int v18; 
  __int64 v19; 
  signed __int32 v20; 
  unsigned int v21; 
  char WsIrql; 
  UINT64 SpinCount; 
  UINT64 v24; 
  UINT64 v25; 

  LODWORD(v24) = 0;
  v2 = *(_QWORD **)Parameter;
  v3 = *((_QWORD *)Parameter + 2);
  v4 = _InterlockedDecrement((volatile signed __int32 *)v3);
  v5 = ~v4 & 0x80000000;
  if( (v4 & 0x7FFFFFFF) != 0 )
  {
    while( (*(_DWORD *)v3 & 0x80000000) != v5 )
      KeYieldProcessorEx(&v24);
  }
  else
  {
    *(_DWORD *)v3 = v5 | *(_DWORD *)(v3 + 4);
    if( !*((_DWORD *)v2 + 10) )
    {
      PfnDb = MmGetPfnDb();
      v7 = &PfnDb[*v2];
      v8 = (_MMSUPPORT_INSTANCE *)v2[8];
      v9 = &PfnDb[v2[1]];
      v10 = 0i64;
      v11 = (v2[7] != 0i64) + 1;
      MiLockWorkingSetShared();
      LODWORD(SpinCount) = 0;
      WsIrql = v13;
      while( _interlockedbittestandset64((volatile signed __int32 *)&v7->u2, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( v7->u2._bf_0 < 0 );
      }
      if( *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)v7->u4._bf_0 >> 39) & 0x3FF)) == v2[4]
        && MiCanStealKernelStack(v7, v11) == 1
        && ((MiGetLeafPfnBuddy(v7) + 32) & 0xFFFFFFFFFFFFFFDFui64) != 0
        && (PteBase = (UINT64)MmGetPteBase(), v2[6] == (__int64)((v7->PteLong << 25) - (PteBase << 25)) >> 16)
        && (Blink = v7->ListEntry.Blink,
            (v10 = (PteBase + (((unsigned __int64)Blink >> 9) & 0x7FFFFFFFF8i64)) & -(__int64)(MiLockPageTableInternal(
                                                                                                 (INT64)v8,
                                                                                                 PteBase
                                                                                               + (((unsigned __int64)Blink >> 9) & 0x7FFFFFFFF8i64),
                                                                                                 (UINT8 *)1) != 0)) != 0) )
      {
        if( v2[7] )
        {
          MiRemoveLockedPageChargeAndDecRef(v7);
          v2[7] = 0i64;
        }
        if( (MiFlags & 0x800) != 0 )
        {
          MiStackTheftFreezeProcessors(v2);
          v15 = 0;
        }
        else
        {
          v15 = MiSwapStackPageNoDpc(0i64, v7, v9) != 1 ? 0xC0000434 : 0;
        }
      }
      else
      {
        v15 = -1073740748;
      }
      *((_DWORD *)v2 + 10) = v15;
      _InterlockedAnd64(&v7->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
      if( v10 )
        MiUnlockPageTableInternal((INT64)v8, v10);
      LOBYTE(PteBase) = WsIrql;
      MiUnlockWorkingSetShared(v8, PteBase);
      v16 = (unsigned __int64 *)v2[2];
      Long = ZeroPte.u.Long;
      LOBYTE(v18) = MiPteInShadowRange((UINT64)v16);
      if( v18 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
        Long = ZeroPte.u.Long | 0x8000000000000000ui64;
      *v16 = Long;
    }
  }
  v19 = *((_QWORD *)Parameter + 2);
  v20 = _InterlockedDecrement((volatile signed __int32 *)v19);
  v21 = ~v20 & 0x80000000;
  if( (v20 & 0x7FFFFFFF) != 0 )
  {
    LODWORD(v25) = 0;
    while( (*(_DWORD *)v19 & 0x80000000) != v21 )
      KeYieldProcessorEx(&v25);
  }
  else
  {
    *(_DWORD *)v19 = v21 | *(_DWORD *)(v19 + 4);
  }
  _InterlockedDecrement(*((volatile signed __int32 **)Parameter + 1));
}

Referenced by: