MmFreePoolMemory

NTSTATUS __stdcall MmFreePoolMemory(UINT64 *a1, UINT64 *a2){
  char *v2; 
  UINT64 v3; 
  UINT64 v4; 
  unsigned int v5; 
  unsigned int v6; 
  int v7; 
  unsigned int v8; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  _MMPTE *v10; 
  _MMPFN *v11; 
  UINT64 Flags; 
  _MI_DELETE_VA_INFO DeleteInfo; 
  UINT64 v15[2]; 
  __int128 v16; 

  v2 = (char *)*a2;
  v3 = *a1;
  v4 = (*a2 >> 12) + ((*a2 & 0xFFF) != 0);
  v5 = MiDeterminePoolType(*a1);
  if( v5 == 32 )
    KeBugCheckEx(0x1Au, (PVOID)0x5305, (PVOID)v3, v2, (PVOID)v6);
  if( v5 == 33 )
    v7 = 1;
  else
    v7 = (v5 != 0) + 5;
  v8 = v6 | 0x4000;
  if( (v6 & 0x8000) == 0 )
    v8 = v6;
  LODWORD(AnyMultiplexedVm) = v8;
  if( (v8 & 0x4000) != 0 )
  {
    if( (v5 & 1) != 0 )
    {
      DeleteInfo = 0i64;
      *(_OWORD *)v15 = 0i64;
      v16 = 0i64;
      v10 = (_MMPTE *)((char *)MmGetPteBase() + ((v3 >> 9) & 0x7FFFFFFFF8i64));
      if( (v5 & 0x20) != 0 )
        AnyMultiplexedVm = (_MMSUPPORT_INSTANCE *)((char *)KeGetCurrentThread()->ApcState.Process->Session + 256);
      else
        AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypePagedPool, (VOID *)v5);
      LODWORD(Flags) = (v8 >> 30) & 1;
      MiDeleteSystemPagableVm(AnyMultiplexedVm, 0i64, v10, v4, Flags, &DeleteInfo);
      v11 = (_MMPFN *)v15[1];
      MiReturnCommit(
        *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * AnyMultiplexedVm->PartitionId),
        v15[1] - *(_QWORD *)&DeleteInfo.ReducedCommitClonePages);
      LOWORD(AnyMultiplexedVm) = v8;
    }
    else
    {
      if( (v8 & 0x40000000) == 0 && MmProtectFreedNonPagedPool )
        LODWORD(AnyMultiplexedVm) = v8 | 0x40000000;
      v11 = MiClearNonPagedPtes((VOID *)v3, v4, (unsigned int)AnyMultiplexedVm, FlushUser);
    }
    if( v11 )
      MiCountSystemPool((unsigned int)v7, (UINT64)v11, 0i64);
  }
  if( ((unsigned __int16)AnyMultiplexedVm & 0x8000) != 0 )
  {
    if( v7 == 1 )
      _InterlockedExchangeAdd(
        (volatile signed __int32 *)KeGetCurrentThread()->ApcState.Process->Session + 217,
        -(int)(v4 >> 9));
    MiReturnSystemVa((VOID *)v3, &v2[v3], (_MI_SYSTEM_VA_TYPE)v7, 0i64);
  }
  return 0;
}

Referenced by: