MiFreeToSubAllocatedRegion

NTSTATUS __stdcall MiFreeToSubAllocatedRegion(PVOID P){
  char *v1; 
  __int64 v2; 
  _ETHREAD *CurrentThread; 
  char *v4; 
  __int64 v5; 
  INT64 ***VadEvent; 
  __int64 v8; 
  _EPROCESS *v9; 
  __int64 v10; 
  unsigned int v11; 
  __int64 v12; 
  INT64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  unsigned int v16; 
  unsigned int v17; 
  unsigned int v18; 
  bool v19; 
  __int64 *i; 
  bool v21; 
  int v22; 
  NTSTATUS result; 
  _QWORD *v24; 
  __int64 v25; 
  __int64 v26; 
  _QWORD *v27; 
  __int64 v28; 
  _QWORD *v29; 
  __int64 v30; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = v1;
  v5 = v2;
  v30 = *((_QWORD *)CurrentThread + 23);
  VadEvent = MiLocateVadEvent((__int64)P, 64i64);
  if( !VadEvent )
    goto LABEL_21;
  v11 = *(unsigned __int8 *)(v8 + 32);
  v12 = *(unsigned int *)(v8 + 24);
  v13 = (INT64)(VadEvent + 1);
  v14 = (unsigned __int64)(v10 + 4095) >> 12;
  LOCK_PAGE_TABLE_COMMITMENT(CurrentThread, v9);
  RtlClearBitsEx(v13, (unsigned __int64)&v4[-4096 * (v12 | ((unsigned __int64)v11 << 32))] >> 12, v14);
  v15 = *(unsigned int *)(v13 + 44);
  v16 = *(_DWORD *)(v13 + 40) - v14;
  *(_DWORD *)(v13 + 40) = v16;
  if( v14 + v16 >= v15 && v16 < (unsigned int)v15 )
  {
    v24 = (_QWORD *)(v13 + 16);
    v25 = *(_QWORD *)(v30 + 1680) + 16 * ((*(_DWORD *)(v13 + 48) & 3) + 20i64);
    v26 = *(_QWORD *)v25;
    if( *(_QWORD *)(*(_QWORD *)v25 + 8i64) != v25 )
      goto LABEL_28;
    *v24 = v26;
    *(_QWORD *)(v13 + 24) = v25;
    *(_QWORD *)(v26 + 8) = v24;
    *(_QWORD *)v25 = v24;
    v16 = *(_DWORD *)(v13 + 40);
  }
  v17 = 0;
  v18 = 0;
  v19 = v16 == 0;
  for( i = (__int64 *)*((_QWORD *)P + 7); i; i = (__int64 *)*i )
  {
    if( *((_DWORD *)i + 16) == 2 )
    {
      if( v18 <= 1 )
        ++v18;
      if( (unsigned __int64)v4 <= i[2] && (unsigned __int64)&v4[v5 - 1] >= (i[1] & 0xFFFFFFFFFFFFF000ui64) && v17 <= 1 )
        ++v17;
    }
  }
  v21 = v19;
  v22 = 1;
  if( v18 != 1 )
    v21 = 0;
  if( v17 != 1 )
    v22 = 0;
  if( v21 )
  {
    v27 = (_QWORD *)(v13 + 16);
    v28 = *(_QWORD *)(v13 + 16);
    if( *(_QWORD *)(v28 + 8) == v13 + 16 )
    {
      v29 = *(_QWORD **)(v13 + 24);
      if( (_QWORD *)*v29 == v27 )
      {
        *v29 = v28;
        *(_QWORD *)(v28 + 8) = v29;
        *v27 = 0i64;
        *(_QWORD *)(v13 + 24) = 0i64;
        goto LABEL_20;
      }
    }
LABEL_28:
    __fastfail(3u);
  }
  if( v22 )
    MiDecommitRegion((_MMVAD_SHORT *)P, v4, &v4[v5 - 1]);
LABEL_20:
  UNLOCK_PAGE_TABLE_COMMITMENT((__int64)CurrentThread, v30);
  if( !v21 )
  {
LABEL_21:
    MiUnlockAndDereferenceVad(P);
    return result;
  }
  MiDeleteVad((_MMVAD *)P, 0i64);
  return result;
}

Referenced by: