MiDeletePagablePteRange

void __fastcall MiDeletePagablePteRange(
        __int64 a1,
        unsigned __int8 a2,
        unsigned __int64 a3,
        unsigned __int64 a4,
        char a5,
        int a6,
        _QWORD *a7){
  unsigned __int64 v7; 
  int v8; 
  unsigned __int64 v10; 
  unsigned __int8 v11; 
  unsigned __int8 CurrentIrql; 
  char v13; 
  int v14; 
  __int64 v15; 
  int v16; 
  int v17; 
  __int16 Type; 
  int v19; 
  char v20; 
  char v21; 
  __int64 v22; 
  _ETHREAD *CurrentThread; 
  __int16 v24; 
  unsigned __int8 v25; 
  LONG *v26; 
  KIRQL v27; 
  INT64 *SharedVm; 
  INT64 *v29; 
  WORK_QUEUE_TYPE v30; 
  PVOID v31; 
  int v32; 
  _MMPTE *PteBase; 
  UINT64 v34; 
  char *i; 
  __int64 v36; 
  bool v37; 
  char v38; 
  int v39; 
  _MMPFN *v40; 
  __int64 v41; 
  INT64 v42; 
  int v44; 
  struct _IO_WORKITEM LockHandle; 
  __int64 v48; 
  unsigned __int64 v49; 
  __int64 v50; 
  __int128 v51; 
  __int128 v52; 
  __int128 v53; 
  __int128 v54; 
  __int128 v55; 
  __int128 v56; 
  __int64 v57; 
  INT64(__fastcall *v58)(INT64, UINT64, INT64); 
  INT64(__fastcall *v59)(INT64 *); 
  __int128 *v60; 
  __int128 v61[6]; 
  __int128 v62; 
  INT64 v63[2]; 
  __int128 v64; 
  __int64 v65; 
  int v66; 
  __int16 v67; 
  __int16 v68; 
  __int64 v69; 
  __int64 v70; 
  __int64 v71; 
  __int128 v72; 
  __int128 v73; 
  __int128 v74; 
  __int128 v75; 
  __int128 v76; 
  __int128 v77; 
  __int128 v78; 
  __int128 v79; 
  __int128 v80; 
  __int64 v81; 
  char v82; 
  v8 = a6;
  v68 = 0;
  v10 = a3;
  v81 = 0i64;
  v11 = a2;
  v82 = 4 * (a5 & 7);
  LOBYTE(v7) = 0;
  v72 = 0i64;
  v73 = 0i64;
  v74 = 0i64;
  v75 = 0i64;
  v76 = 0i64;
  v77 = 0i64;
  v78 = 0i64;
  v79 = 0i64;
  v80 = 0i64;
  memset(&LockHandle, 0, 24);
  while( 1 )
  {
    v44 = v7;
    CurrentIrql = v11;
    v65 = 2i64;
    v13 = 0;
    v57 = 0i64;
    v62 = 0i64;
    v61[1] = (unsigned __int64)a7;
    v61[0] = 0i64;
    DWORD2(v62) = v8;
    memset(&v61[2], 0, 64);
    *(_OWORD *)v63 = 0i64;
    v64 = 0i64;
    *(_OWORD *)&LockHandle.Type = 0i64;
    v51 = 0i64;
    v52 = 0i64;
    v53 = 0i64;
    v54 = 0i64;
    v55 = 0i64;
    v56 = 0i64;
    v66 = MiTbFlushType(a1);
    *(_QWORD *)&LockHandle.ActivityId.Data4[4] = &v66;
    v67 = 0;
    v70 = 0i64;
    v71 = 0i64;
    v69 = 20i64;
    BYTE2(LockHandle.Type) = v82 | _mm_cvtsi128_si32(_mm_srli_si128((__m128i)0i64, 2)) & 0xE3;
    v60 = v61;
    Type = 39;
    LOWORD(LockHandle.Type) = 39;
    if( v19 )
    {
      Type = 1059;
      LOWORD(LockHandle.Type) = 1059;
    }
    if( v14 )
    {
      Type |= 0x800u;
      LOWORD(LockHandle.Type) = Type;
    }
    v20 = BYTE1(LockHandle.ActivityId.Data1);
    v49 = v10;
    if( v17 )
      v20 = 63;
    v50 = v15;
    BYTE1(LockHandle.ActivityId.Data1) = v20;
    v21 = 0;
    v48 = a1;
    v58 = MiDeleteVa;
    v59 = MiDeleteVaTail;
    if( v16 )
    {
      v22 = *(_QWORD *)(a7[4] + 32i64);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 243);
      ExAcquireAutoExpandPushLockExclusive(v22 + 56, 0i64);
      Type = LockHandle.Type;
    }
    if( a2 != 17 )
    {
      v21 = 1;
      v24 = Type & 0xFFFD;
      LOWORD(LockHandle.Type) = v24;
      goto LABEL_22;
    }
    if( (LockHandle.Type & 4) == 0 )
    {
      SharedVm = MiGetSharedVm(a1);
      v27 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
      *((_DWORD *)SharedVm + 1) = 0;
LABEL_20:
      LODWORD(v7) = v44;
      CurrentIrql = v27;
      goto LABEL_21;
    }
    v25 = *(_BYTE *)(a1 + 184) & 7;
    if( v25 < 6u )
    {
      v26 = &dword_140C4F4C0;
      if( v25 != 2 )
        v26 = (LONG *)(a1 + 192);
      v27 = ExAcquireSpinLockShared(v26);
      if( v26[1] )
        _InterlockedExchange(v26 + 1, 0);
      goto LABEL_20;
    }
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
LABEL_21:
    v24 = LockHandle.Type;
LABEL_22:
    BYTE2(LockHandle.ActivityId.Data1) = CurrentIrql;
    if( (a6 & 0x100) != 0 )
    {
      if( (a6 & 0x200) == 0 )
        v24 = v24 & 0xEFFB | 0x1000;
      LOWORD(LockHandle.Type) = v24 & 0xFFFD;
      v29 = MiGetSharedVm(a1);
      LockHandle.WorkItem.List.Flink = 0i64;
      LockHandle.WorkItem.List.Blink = (_LIST_ENTRY *)(v29 + 8);
      KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)(v29 + 8), v30, v31);
    }
    if( (a6 & 0x80) == 0 )
      goto LABEL_37;
    if( (_BYTE)v7 )
      goto LABEL_37;
    if( ((a4 ^ v10) & 0xFFFFFFE00000i64) != 0 )
      goto LABEL_37;
    v32 = MiFastLockLeafPageTable(a1, v10);
    if( !v32 )
      goto LABEL_37;
    PteBase = MmGetPteBase();
    v7 = (unsigned __int64)PteBase + ((v10 >> 9) & 0x7FFFFFFFF8i64);
    LockHandle.WorkItem.Parameter = (void *)v7;
    LockHandle.Routine = (void(__fastcall *)(void *, void *, _IO_WORKITEM *))((char *)PteBase
                                                                             + ((v7 >> 9) & 0x7FFFFFFFF8i64));
    LockHandle.IoObject = (char *)PteBase + (((unsigned __int64)LockHandle.Routine >> 9) & 0x7FFFFFFFF8i64);
    LockHandle.Context = (char *)PteBase + (((unsigned __int64)LockHandle.IoObject >> 9) & 0x7FFFFFFFF8i64);
    v34 = *((_QWORD *)&LockHandle.WorkItem.Parameter + v32);
    if( v32 == 1 )
    {
      for( i = (char *)PteBase + ((a4 >> 9) & 0x7FFFFFFFF8i64); v7 <= (unsigned __int64)i; v7 += 8 * v36 )
      {
        MiDeleteVa((INT64)&LockHandle.Type, v7, 0i64);
        v36 = (unsigned int)HIBYTE(LockHandle.Type) + 1;
        HIBYTE(LockHandle.Type) = 0;
      }
      MiDeleteVaTail((INT64 *)&LockHandle.Type);
      v37 = (*((_DWORD *)MiGetUsedPtesHandle(a3) + 4) & 0x3FF0000) == 0;
      v38 = v44;
      if( v37 )
        v38 = 1;
      v13 = 1;
      LOBYTE(v44) = v38;
    }
    MiUnlockPageTableInternal(a1, v34);
    if( !v13 )
LABEL_37:
      MiWalkPageTables((INT64)&LockHandle.Type);
    if( (a6 & 0x100) != 0 )
    {
      KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
      if( (a6 & 0x200) == 0 )
        LOWORD(LockHandle.Type) |= 4u;
    }
    if( !v21 )
    {
      if( (LockHandle.Type & 4) != 0 )
      {
        if( (*(_BYTE *)(a1 + 184) & 7u) < 6 )
        {
          v39 = *(_DWORD *)(a1 + 184);
          if( (v39 & 0x8000000) != 0 || (v39 & 0x4000000) != 0 || (v39 & 0x10000000) != 0 )
          {
            MiPreUnlockWorkingSetShared(a1, CurrentIrql);
            LOBYTE(v39) = *(_BYTE *)(a1 + 184);
          }
          v7 = (unsigned __int64)&dword_140C4F4C0;
          if( (v39 & 7) != 2 )
            v7 = a1 + 192;
          MiCheckProcessShadow();
          _InterlockedAnd((volatile signed __int32 *)v7, 0xBFFFFFFF);
          _InterlockedDecrement((volatile signed __int32 *)v7);
        }
        __writecr8(CurrentIrql);
      }
      else
      {
        MiUnlockWorkingSetExclusive(a1, CurrentIrql);
      }
    }
    v40 = (_MMPFN *)a7[5];
    if( (__int64)v40 < 0 )
    {
      MiFreeLargePages(v40);
      a7[1] = v41;
      a7[5] = 0i64;
    }
    v42 = a7[4];
    if( v42 && v63[0] )
      MiFreePhysicalPageChain(v42, v63[0], 1i64);
    if( (a6 & 0x10) != 0 )
    {
      v7 = (unsigned __int64)KeGetCurrentThread();
      ExReleaseAutoExpandPushLockExclusive(*(_QWORD *)(a7[4] + 32i64) + 56i64, 0i64);
      KiLeaveGuardedRegionUnsafe(v7);
    }
    if( (_BYTE)v44 != 1 )
      break;
    v10 = a3;
    LOBYTE(v7) = 2;
    v11 = a2;
    v8 = a6;
  }
}

Referenced by: