MiReturnPhysicalPoolPages

VOID __stdcall MiReturnPhysicalPoolPages(_MMPFN *PfnList){
  char v1; 
  _MMPFN *PfnDb; 
  _MMPFN *v3; 
  _MMPFN *v4; 
  __int64 v5; 
  char v6; 
  __int64 v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  _MMPFN *v10; 
  unsigned __int64 v11; 
  _QWORD *v12; 
  _MMPFN *v13; 
  _MMPFN *v14; 
  _MMPFN *v15; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  UINT64 v17[2]; 
  __int128 v18; 
  __int128 v19; 
  int v20; 
  int v21; 
  unsigned int v22; 
  _MMPFN *v23; 
  PfnDb = MmGetPfnDb();
  v3 = PfnList;
  v23 = 0i64;
  v4 = 0i64;
  v5 = 0i64;
  v6 = v1;
  memset(&LockHandle, 0, sizeof(LockHandle));
  *(_OWORD *)v17 = 0i64;
  v18 = 0i64;
  v19 = 0i64;
  LODWORD(v7) = MiSearchNumaNodeTable((PVOID)((PfnList - PfnDb) / 48));
  v22 = *(_DWORD *)(v7 + 8);
  v21 = v6 & 1;
  v20 = v6 & 2;
  do
  {
    v15 = *(_MMPFN **)v3;
    v14 = v4;
    v13 = v4;
    v8 = (v3 - PfnDb) / 48;
    v9 = (unsigned __int8)MiLockPageInline((INT64)v3);
    if( !v20 )
    {
      v11 = *((_QWORD *)v3 + 3) & 0xC000000000000001ui64;
      *((_WORD *)v3 + 16) = 1;
      *((_QWORD *)v3 + 3) = v11 | 1;
    }
    if( !v21 && (*((_BYTE *)v3 + 35) & 0x10) != 0 )
    {
      ++v5;
      v4 = v3;
      v10 = v3;
      *((_BYTE *)v3 + 34) = *((_BYTE *)v3 + 34) & 0xF8 | 5;
      *((_QWORD *)v3 + 3) &= 0xC000000000000000ui64;
      *((_WORD *)v3 + 16) = 0;
      if( v13 )
        v4 = v14;
      *((_QWORD *)v3 + 1) = -8i64;
      *(_QWORD *)v3 = v23;
      v23 = v3;
    }
    else
    {
      *((_WORD *)v3 + 16) = 0;
      *((_QWORD *)v3 + 3) &= 0xC000000000000000ui64;
      MiInsertPageInFreeOrZeroedList(v8, 2ui64);
      v10 = v23;
      ++v17[0];
      ++*((_QWORD *)&v18 + 1);
    }
    _InterlockedAnd64((volatile signed __int64 *)v3 + 3, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(v9);
    PfnDb = MmGetPfnDb();
    v3 = v15;
  }
  while( v15 );
  if( v5 )
  {
    v12 = (_QWORD *)((char *)SListHead + 176 * v22);
    KeAcquireInStackQueuedSpinLock(v12 + 18, &LockHandle);
    *(_QWORD *)v4 = v12[19];
    v12[17] += v5;
    v12[19] = v10;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
  }
  MiReturnPoolCharges(v17, (unsigned int)(2 * v21));
}

Referenced by: