MmCheckCachedPageStates

VOID __fastcall MmCheckCachedPageStates(
        VOID *SystemCacheAddress,
        UINT64 NumberOfBytes,
        UINT64 Flags,
        UINT8 *ReturnResult){
  unsigned int v5; 
  ULONG_PTR v6; 
  _MMPFN *v7; 
  _MMPTE *PteBase; 
  UINT64 v9; 
  UINT64 v10; 
  char *v11; 
  UINT64 v12; 
  __int64 v13; 
  UINT64 CurrentPrcb; 
  INT64 *v15; 
  __int64 v16; 
  char *v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  ULONG_PTR v20; 
  __int64 v21; 
  unsigned __int64 v22; 
  INT64 v23; 
  __int64 v24; 
  __int64 v25; 
  signed __int32 v26; 
  UINT64 Page; 
  UINT64 v28; 
  _RTL_BITMAP_EX *v29; 
  unsigned __int64 v30; 
  _MI_PFN_CACHE_ATTRIBUTE v31; 
  BOOL v32; 
  UINT8 v33; 
  INT64 v34; 
  UINT64 *v35; 
  UINT64 v36; 
  UINT64 v37; 
  __int64 v38; 
  UINT8 CurrentIrql; 
  UINT64 v40; 
  UINT8 v41; 
  WCHAR *v42; 
  int v43; 
  INT64 v44; 
  char v45; 
  int IsPfnCommitNotCharged; 
  char v47; 
  __int64 v48; 
  ULONG_PTR *v49; 
  signed __int32 v50; 
  signed __int32 v51; 
  MMPTE *v52; 
  char v53; 
  int v54; 
  INT64 v55; 
  unsigned __int64 v56; 
  char *v57; 
  bool v58; 
  __int64 *v59; 
  __int64 v60; 
  unsigned __int64 v61; 
  struct _SLIST_ENTRY *TransitionHeatBatch; 
  __int64 v63; 
  unsigned __int64 v64; 
  unsigned __int64 v65; 
  _MMPFN *v66; 
  __int64 PfnPriority; 
  WORK_QUEUE_TYPE v68; 
  PVOID v69; 
  int v70; 
  UINT64 v71; 
  __int64 v72; 
  __int64 v73; 
  char v74; 
  _MMPTE *v75; 
  _MMPTE *Pml4eBase; 
  unsigned __int64 v77; 
  int v78; 
  unsigned __int64 v79; 
  __int64 v80; 
  unsigned __int64 v81; 
  unsigned __int64 v82; 
  unsigned __int64 v83; 
  _MMPTE *PxeUserLimit; 
  INT64 PteShadow; 
  unsigned __int64 v86; 
  INT64 v87; 
  _ETHREAD *CurrentThread; 
  int v89; 
  unsigned int v90; 
  unsigned int v91; 
  __int64 v92; 
  NTSTATUS v93; 
  int v94; 
  unsigned __int64 v95; 
  INT64 v96; 
  UINT64 v97; 
  unsigned __int8 v98; 
  unsigned __int64 v99; 
  UINT64 v100; 
  __int16 v101; 
  __int16 v102; 
  struct _KPRCB *v103; 
  WCHAR *v104; 
  UNICODE_STRING *v105; 
  char v106; 
  int v107; 
  unsigned __int64 v108; 
  unsigned __int64 v109; 
  unsigned __int64 v110; 
  int v111; 
  __int64 v112; 
  __int64 v113; 
  __int64 v114; 
  signed __int32 v115; 
  UINT8 PageIrql; 
  char i; 
  unsigned int BatchCount; 
  char BatchCount_4; 
  int v120; 
  INT64 ValidPte; 
  _MMPTE *PoINTerPte; 
  int v123; 
  UINT64 v124; 
  ULONG_PTR BugCheckParameter1; 
  INT64 v126; 
  char *v127; 
  _RTL_BITMAP_EX *v128; 
  UINT64 SpinCount; 
  UINT64 v130; 
  _MMPFN *PfnToDiscard; 
  unsigned __int64 v132; 
  UINT64 v133; 
  UINT64 v134; 
  UINT64 v135; 
  __int64 v136; 
  _MI_PARTITION *Partition; 
  INT64 v138; 
  INT64 v139[2]; 
  UINT8 *v140; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  __int64 v142[16]; 
  v140 = ReturnResult;
  v120 = Flags;
  PfnToDiscard = 0i64;
  ValidPte = 0i64;
  v126 = 0i64;
  BatchCount_4 = 1;
  *(_OWORD *)v139 = 0i64;
  v123 = 0;
  v5 = 0;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v6 = 0i64;
  BatchCount = 0;
  v7 = 0i64;
  PageIrql = 17;
  v133 = 0i64;
  PteBase = MmGetPteBase();
  v9 = (UINT64)PteBase + (((unsigned __int64)SystemCacheAddress >> 9) & 0x7FFFFFFFF8i64);
  PoINTerPte = (_MMPTE *)v9;
  v132 = (unsigned __int64)PteBase
       + ((((unsigned __int64)SystemCacheAddress + NumberOfBytes - 1) >> 9) & 0x7FFFFFFFF8i64);
  v134 = *(_QWORD *)((char *)PteBase + ((v9 >> 9) & 0x7FFFFFFFF8i64));
  v10 = v134;
  MiPteInShadowRange((UINT64)&v134);
  v11 = (char *)MmGetPfnDb() + 48 * ((v10 >> 12) & 0xFFFFFFFFFi64);
  v127 = v11;
  v12 = *(_QWORD *)((char *)MmGetPdeBase() + (((unsigned __int64)SystemCacheAddress >> 18) & 0x3FFFFFF8));
  v135 = v12;
  MiPteInShadowRange((UINT64)&v135);
  v13 = *((_QWORD *)MmGetPfnDb() + 6 * ((v12 >> 12) & 0xFFFFFFFFFi64) + 2);
  if( v13 )
    v13 += 40 * (((unsigned __int64)SystemCacheAddress >> 18) & 7);
  CurrentPrcb = *(_QWORD *)(v13 + 24);
  v15 = (INT64 *)(CurrentPrcb & 0xFFFFFFFFFFFFFFFEui64);
  if( (CurrentPrcb & 1) == 0 )
    v15 = (INT64 *)CurrentPrcb;
  v138 = *v15;
  v16 = 0i64;
  Partition = *(_MI_PARTITION **)(qword_140C4E388 + 8i64 * (*(_WORD *)(v138 + 60) & 0x3FF));
  while( 1 )
  {
    v17 = (char *)MmGetPfnDb() + 40;
    if( v9 > v132 )
      break;
    v18 = *(_QWORD *)v9;
    LODWORD(v19) = 0;
    CurrentPrcb = *(_QWORD *)v9;
    if( (*(_QWORD *)v9 & 1) != 0 )
    {
      if( (v120 & 4) == 0 )
        goto LABEL_196;
      if( PageIrql != 17 )
      {
        MiUnlockProtoPoolPage(v7, PageIrql);
        PageIrql = 17;
      }
LABEL_11:
      MiMarkPteDirty((MMPTE *)v9);
      goto LABEL_196;
    }
    ValidPte = *(_QWORD *)v9;
    if( (v18 & 1) != 0 )
    {
      if( (v120 & 4) == 0 )
        goto LABEL_196;
      if( PageIrql != 17 )
      {
        MiUnlockProtoPoolPage(v7, PageIrql);
        PageIrql = 17;
      }
      goto LABEL_11;
    }
    v20 = v6;
    v19 = (v18 >> 3) & 1;
    v21 = v18;
    v136 = v19;
    if( qword_140C4DC80 && (v18 & 0x10) == 0 )
      v21 = v18 & ~qword_140C4DC80;
    CurrentPrcb = PageIrql;
    v22 = v20 & 0xFFFFFFFFFFFFF000ui64;
    v6 = v21 >> 16;
    BugCheckParameter1 = v6;
    if( PageIrql != 17 )
    {
      if( (v6 & 0xFFFFFFFFFFFFF000ui64) == v22 )
        goto LABEL_91;
      MiUnlockProtoPoolPage(v7, PageIrql);
      PageIrql = 17;
    }
    if( (v6 & 0xFFFFFFFFFFFFF000ui64) != v22 && BatchCount )
    {
      MiMakeSystemCacheRangeValid((_MMPTE *)(v9 - 8i64 * BatchCount), (_MMPTE *)v142, BatchCount, (_MMPFN *)v11);
      BatchCount = 0;
    }
    v23 = *(_QWORD *)v6;
    v126 = v23;
    if( (v23 & 1) == 0 && ((v23 & 0x400) != 0 || (v23 & 0x800) == 0) )
    {
      v7 = 0i64;
LABEL_30:
      if( qword_140C4DC80 && (v23 & 0x10) == 0 )
        v23 &= ~qword_140C4DC80;
      v24 = v23 >> 16;
      if( !MiControlAreaUsingExtents(v138) && (v120 & 1) != 0 )
      {
        MiInitializePageColorBase(0i64, (*(_DWORD *)(v25 + 56) >> 20) & 0x3F, (INT64)v139);
        v26 = _InterlockedExchangeAdd((volatile signed __int32 *)v139[0], 1u);
        Page = MiGetPage(Partition, v139[1] & v26 | HIDWORD(v139[1]), 2ui64);
        v28 = Page;
        if( Page != -1i64 )
        {
          v29 = (_RTL_BITMAP_EX *)((char *)MmGetPfnDb() + 48 * Page);
          v128 = v29;
          v30 = MI_READ_PTE_LOCK_FREE((INT64)&v126);
          v31 = (unsigned int)MiProtectionToCacheAttribute((v30 >> 5) & 0x1F);
          v32 = MiPfnZeroingNeeded((INT64)v29, (unsigned int)v31);
          v33 = PageIrql;
          if( v32 )
          {
            if( PageIrql != 17 )
            {
              MiUnlockProtoPoolPage(v7, PageIrql);
              v33 = 17;
              PageIrql = 17;
            }
            MiZeroPhysicalPage(v28, 1ui64, v31);
            v29[1].SizeOfBitMap &= 0xFFFFFFFFFFFFFC1Fui64;
          }
          v6 = BugCheckParameter1;
          if( v33 != 17 )
            goto LABEL_180;
          v7 = MiLockProtoPoolPage((_MMPTE *)BugCheckParameter1, &PageIrql);
          if( !v7 )
          {
            do
            {
              MmAccessFault(2ui64, (PVOID)v6, 0, 0i64);
              v7 = MiLockProtoPoolPage((_MMPTE *)v6, &PageIrql);
            }
            while( !v7 );
            v29 = v128;
          }
          v34 = MI_READ_PTE_LOCK_FREE(v6);
          v126 = v34;
          if( (v34 & 1) == 0 && ((v34 & 0x800) == 0 || (v34 & 0x400) != 0) )
          {
LABEL_180:
            MiReferenceControlAreaPfn((_CONTROL_AREA *)v138, (_SUBSECTION *)v24, 1ui64);
            v86 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v126) >> 5) & 0x1F;
            MiInitializePfn(v29, (UINT64 *)v6, v86);
            v87 = v28;
            v9 = (UINT64)PoINTerPte;
            ValidPte = MiMakeValidPte((UINT64)PoINTerPte, v87, (unsigned int)v86 | 0x20000000);
            *(_QWORD *)v6 = ValidPte;
            v16 = 0i64;
            goto LABEL_210;
          }
          MiUnlockProtoPoolPage(v7, PageIrql);
          MiReleaseFreshPage((_MMPFN *)v29);
          v9 = (UINT64)PoINTerPte;
          PageIrql = 17;
          goto LABEL_127;
        }
        v9 = (UINT64)PoINTerPte;
      }
      if( (v120 & 2) == 0 )
      {
        if( PageIrql != 17 )
        {
          MiUnlockProtoPoolPage(v7, PageIrql);
          PageIrql = 17;
        }
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        v89 = *((unsigned __int8 *)CurrentThread + 1308);
        v90 = *((_DWORD *)CurrentThread + 322);
        *((_BYTE *)CurrentThread + 1308) = 1;
        v91 = v89 + 4 * v90;
        v92 = (__int64)(v132 - v9) >> 3;
        if( (unsigned int)v92 > v90 )
        {
          if( (unsigned int)v92 > 0xF )
            LODWORD(v92) = 15;
          *((_DWORD *)CurrentThread + 322) = v92;
        }
        v93 = MmAccessFault(0i64, (PVOID)((__int64)((v9 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16), 0, 0i64);
        if( v93 < 0 )
        {
          v94 = v123;
          if( v123 >= 0 )
            v94 = v93;
          v123 = v94;
        }
        *((_DWORD *)CurrentThread + 322) = v91 >> 2;
        *((_BYTE *)CurrentThread + 1308) = v91 & 3;
      }
      BatchCount_4 = 0;
      goto LABEL_195;
    }
    v35 = (UINT64 *)((char *)MmGetPteBase() + ((v6 >> 9) & 0x7FFFFFFFF8i64));
    while( 2 )
    {
      v124 = *v35;
      v36 = v124 & 1;
      do
      {
        if( !v36 )
          goto LABEL_61;
        v37 = v124;
        if( (v124 & 0x200) != 0 )
          goto LABEL_61;
        MiPteInShadowRange((UINT64)&v124);
        v38 = (v37 >> 12) & 0xFFFFFFFFFi64;
      }
      while( (*((_QWORD *)MmGetPfnDb() + 6 * v38 + 5) & 0x4000000000000i64) == 0 );
      v7 = (_MMPFN *)((char *)MmGetPfnDb() + 48 * v38);
      CurrentIrql = KeGetCurrentIrql();
      __writecr8(2ui64);
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)v7 + 6, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( *((__int64 *)v7 + 3) < 0 );
      }
      v40 = *v35;
      v124 = v40;
      if( (v40 & 1) == 0 || (v40 & 0x200) != 0 || v38 != ((v40 >> 12) & 0xFFFFFFFFFi64) )
      {
        _InterlockedAnd64((volatile signed __int64 *)v7 + 3, 0x7FFFFFFFFFFFFFFFui64);
        if( CurrentIrql != 17 )
          __writecr8(CurrentIrql);
LABEL_61:
        MmAccessFault(2ui64, (PVOID)BugCheckParameter1, 0, 0i64);
        continue;
      }
      break;
    }
    if( !(unsigned int)MiAreChargesNeededToLockPage((INT64)v7) )
      goto LABEL_78;
    LOBYTE(v43) = MI_PFN_IS_PROTO((UNICODE_STRING *)v7, (UNICODE_STRING *)CurrentPrcb, v41, v42);
    if( v43 && (*((_DWORD *)v7 + 4) & 0x400i64) != 0 )
    {
      v45 = 1;
    }
    else
    {
      IsPfnCommitNotCharged = MiIsPfnCommitNotCharged(v44);
      v45 = v47;
      if( IsPfnCommitNotCharged )
        v45 = 1;
    }
    v48 = (*((_QWORD *)v7 + 5) >> 39) & 0x3FFi64;
    v49 = *(ULONG_PTR **)(qword_140C4E388 + 8 * v48);
    if( v45 && !(unsigned int)MiChargeCommit(*(_MI_PARTITION **)(qword_140C4E388 + 8 * v48), 1ui64, 4ui64) )
      goto LABEL_79;
    if( v49 == &MiSystemPartition )
    {
      CurrentPrcb = (UINT64)KeGetCurrentPrcb();
      v50 = *(_DWORD *)(CurrentPrcb + 33564);
      while( v50 )
      {
        if( v50 == -1 )
          break;
        v51 = v50;
        v50 = _InterlockedCompareExchange((volatile signed __int32 *)(CurrentPrcb + 33564), v50 - 1, v50);
        if( v51 == v50 )
          goto LABEL_78;
      }
    }
    if( (unsigned int)MiChargePartitionResidentAvailable((INT64)v49, 1ui64, 0xFFFFFFFFi64) )
    {
LABEL_78:
      ++*((_WORD *)v7 + 16);
    }
    else if( v45 )
    {
      MiReturnCommit((_MI_PARTITION *)v49, 1ui64);
    }
LABEL_79:
    if( CurrentIrql == 17 )
    {
      MiLockOwnedProtoPage((INT64)v7, 0x11u);
    }
    else
    {
      v52 = (MMPTE *)(*((_QWORD *)v7 + 1) | 0x8000000000000000ui64);
      PageIrql = CurrentIrql;
      v53 = *((_BYTE *)v7 + 34);
      i = 0;
      v128 = (_RTL_BITMAP_EX *)v52;
      if( (v53 & 0x20) != 0 )
      {
        do
        {
          _InterlockedAnd64((volatile signed __int64 *)v7 + 3, 0x7FFFFFFFFFFFFFFFui64);
          __writecr8(CurrentIrql);
          v54 = 0;
          for( i = *((_BYTE *)v7 + 34); (i & 0x20) != 0; i = *((_BYTE *)v7 + 34) )
          {
            ++v54;
            _mm_pause();
          }
          MiLockPageInline((INT64)v7);
          v53 = *((_BYTE *)v7 + 34);
        }
        while( (v53 & 0x20) != 0 );
        v52 = (MMPTE *)v128;
      }
      *((_BYTE *)v7 + 34) = v53 | 0x20;
      if( (*((_QWORD *)v7 + 3) & 0x4000000000000000i64) == 0 && (*(_BYTE *)v52 & 0x20) == 0 )
        MiWriteValidPteVolatile(v52, 1ui64);
      _InterlockedAnd64((volatile signed __int64 *)v7 + 3, 0x7FFFFFFFFFFFFFFFui64);
    }
    v11 = v127;
    v16 = 0i64;
    v6 = BugCheckParameter1;
    LODWORD(v19) = v136;
    v9 = (UINT64)PoINTerPte;
    v17 = (char *)MmGetPfnDb() + 40;
LABEL_91:
    if( (*(_BYTE *)v9 & 1) != 0 )
      goto LABEL_196;
    v23 = *(_QWORD *)v6;
    v126 = v23;
    if( (v23 & 1) == 0 && ((v23 & 0x400) != 0 || (v23 & 0x800) == 0) )
      goto LABEL_30;
    while( 1 )
    {
      while( 1 )
      {
        v55 = *(_QWORD *)v6;
        if( (*(_QWORD *)v6 & 1) == 0 )
          break;
        v56 = *(_QWORD *)v6;
LABEL_105:
        CurrentPrcb = 6 * ((v56 >> 12) & 0xFFFFFFFFFi64);
        if( (*(_QWORD *)&v17[48 * ((v56 >> 12) & 0xFFFFFFFFFi64)] & 0x4000000000000i64) != 0 )
        {
          v57 = (char *)MmGetPfnDb() + 48 * ((v56 >> 12) & 0xFFFFFFFFFi64);
          HIDWORD(SpinCount) = 0;
          if( _interlockedbittestandset64((volatile signed __int32 *)v57 + 6, 0x3Fui64) )
          {
            do
            {
              do
                KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
              while( *((__int64 *)v57 + 3) < 0 );
            }
            while( _interlockedbittestandset64((volatile signed __int32 *)v57 + 6, 0x3Fui64) );
            v17 = (char *)MmGetPfnDb() + 40;
          }
          if( *(_QWORD *)v6 == v55 )
            goto LABEL_113;
          _InterlockedAnd64((volatile signed __int64 *)v57 + 3, 0x7FFFFFFFFFFFFFFFui64);
        }
      }
      if( (v55 & 0x400) != 0 || (v55 & 0x800) == 0 )
        break;
      if( !v55 || !qword_140C4DC80 || (v55 & qword_140C4DC80) != 0 )
      {
        v56 = *(_QWORD *)v6;
        if( qword_140C4DC80 && (v55 & 0x10) == 0 )
          v56 = v55 & ~qword_140C4DC80;
        goto LABEL_105;
      }
    }
    v57 = 0i64;
LABEL_113:
    v23 = *(_QWORD *)v6;
    v126 = *(_QWORD *)v6;
    if( !v57 )
      goto LABEL_30;
    if( (v23 & 1) == 0 )
    {
      if( (v57[34] & 0x20) == 0 && (v57[35] & 0x40) == 0 )
      {
        v59 = (__int64 *)(v57 + 16);
        v60 = *((_QWORD *)v57 + 2) >> 11;
        v61 = ((__int64)(v132 - v9) >> 3) + 1;
        if( (*((_QWORD *)v57 + 2) & 0x400i64) == 0 )
          v60 = *((_QWORD *)v57 + 2) >> 3;
        if( (v60 & 1) != 0 )
        {
          TransitionHeatBatch = (struct _SLIST_ENTRY *)MiMakeTransitionHeatBatch((INT64)v57);
          if( TransitionHeatBatch )
          {
            _InterlockedAnd64((volatile signed __int64 *)v57 + 3, 0x7FFFFFFFFFFFFFFFui64);
            MiUnlockProtoPoolPage(v7, PageIrql);
            PageIrql = 17;
            if( TransitionHeatBatch == (struct _SLIST_ENTRY *)-1i64 )
            {
              MiReplenishTransitionPageHeatList();
            }
            else
            {
              MiProcessTransitionHeatBatch((INT64)TransitionHeatBatch);
              MiFreeTransitionPageHeatList(TransitionHeatBatch);
            }
LABEL_127:
            v11 = v127;
            v16 = 0i64;
            v5 = BatchCount;
            v6 = 0i64;
            continue;
          }
        }
        if( (v57[34] & 7) != 2
          || v61 <= 1
          || MiIsPfnFromSlabAllocation((INT64)v57) && !*((_WORD *)v57 + 16) && *(__int64 *)v57 < 0 )
        {
          goto LABEL_147;
        }
        v63 = *v59;
        if( qword_140C4DC80 && (v63 & 0x10) == 0 )
          v63 &= ~qword_140C4DC80;
        if( (__int64)(*(_QWORD *)((v63 >> 16) + 8) + 8i64 * *(unsigned int *)((v63 >> 16) + 0x2C) - v6) >> 3 < v61 )
          v61 = (__int64)(*(_QWORD *)((v63 >> 16) + 8) + 8i64 * *(unsigned int *)((v63 >> 16) + 0x2C) - v6) >> 3;
        v64 = (unsigned __int64)(4096 - (unsigned int)(v6 & 0xFFF)) >> 3;
        if( v61 <= v64 )
          v64 = v61;
        v65 = 16 - BatchCount;
        if( v64 <= v65 )
          v65 = v64;
        if( v65 > 1 )
        {
          v66 = 0i64;
          PfnToDiscard = 0i64;
          PfnPriority = (unsigned int)MiGetPfnPriority((INT64)v57);
          LockHandle.LockQueue.Next = 0i64;
          LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)((char *)Partition
                                                                 + 32 * PfnPriority
                                                                 + 8 * PfnPriority
                                                                 + 2464);
          KxAcquireQueuedSpinLock((PIO_WORKITEM)&LockHandle, (PIO_WORKITEM_ROUTINE)LockHandle.LockQueue.Lock, v68, v69);
          v70 = MiUnlinkPageFromList((_MMPFN *)v57, 1ui64);
          if( v70 == 1 )
          {
            v71 = MiUnlinkStandbyBatch(
                    (_MMPFN *)&PfnToDiscard,
                    (_MMPTE *)(BugCheckParameter1 + 8),
                    (unsigned int)PfnPriority,
                    PoINTerPte,
                    v65 - 1,
                    &PfnToDiscard);
            v66 = PfnToDiscard;
            v133 = v71;
          }
          KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
          if( v66 )
          {
            MiDiscardTransitionPteEx((UINT64)v66, 0i64);
            v72 = 0x7FFFFFFFFFFFFFFFi64;
            _InterlockedAnd64((volatile signed __int64 *)v66 + 3, 0x7FFFFFFFFFFFFFFFui64);
LABEL_149:
            if( v70 )
            {
              v73 = *((_QWORD *)v57 + 1);
              v74 = v57[34] & 0xFE;
              ++*((_WORD *)v57 + 16);
              v57[34] = v74 | 6;
              v75 = (_MMPTE *)(v73 | 0x8000000000000000ui64);
              Pml4eBase = MmGetPml4eBase();
              v77 = (unsigned __int8)*v59 >> 5;
              v78 = (unsigned __int8)v57[34] >> 6;
              if( v78 != 1 )
              {
                if( v78 )
                {
                  if( v78 == 2 )
                    v77 = (unsigned int)v77 | 0x18;
                }
                else
                {
                  v77 = (unsigned int)v77 | 8;
                }
              }
              v79 = (unsigned __int64)MmGetPteBase();
              v80 = (((v57 - (char *)MmGetPfnDb()) / 48) & 0xFFFFFFFFFi64) << 12;
              v81 = v80 | MmProtectToPteMask[v77] & 0xFFFF000000000E7Fui64 | 0x21;
              v9 = (UINT64)PoINTerPte;
              if( (unsigned __int64)PoINTerPte < v79 || PoINTerPte > MmGetPteLimit() )
              {
                v82 = v80 | MmProtectToPteMask[v77] & 0xFFFF000000000E7Fui64 | 0x121;
              }
              else
              {
                if( PoINTerPte >= MmGetPdeBase() && PoINTerPte <= MmGetPdeLimit() )
                {
                  v81 = PoINTerPte == MmGetPxeSelfRef() ? v80 | MmProtectToPteMask[v77] & 0xFFFF000000000E7Fui64 | 0x8000000000000021ui64 : v80 & 0x7FFFFFFFFFFFFFFFi64 | MmProtectToPteMask[v77] & 0x7FFF000000000E7Fi64 | 0x21;
                  if( (unsigned int)MiUserPdeOrAbove((UINT64)PoINTerPte) )
                    v81 |= 4ui64;
                }
                if( v9 <= v79 + 0x3FFFFFFF78i64 )
                  v81 |= 4ui64;
                v82 = v81 | 0x100;
                if( !(unsigned int)MiIsAddressGlobal((__int64)((v9 << 25) - (v79 << 25)) >> 16) )
                  v82 = v77;
              }
              v83 = v82 & 0xFAFFFFFFFFFFFEFFui64 | ((word_140C4DD48 & 1 | 0xA000000000000i64) << 8);
              PxeUserLimit = MmGetPxeUserLimit();
              if( v75 >= Pml4eBase
                && v75 <= PxeUserLimit
                && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 )
              {
                v83 |= 0x8000000000000000ui64;
              }
              *(_QWORD *)v75 = v83;
              v6 = BugCheckParameter1;
              *((_QWORD *)v57 + 3) = *((_QWORD *)v57 + 3) & 0xC000000000000000ui64 | 1;
              PteShadow = *(_QWORD *)v6;
              if( v6 >= (unsigned __int64)Pml4eBase && v6 <= (unsigned __int64)PxeUserLimit )
                PteShadow = MiReadPteShadow((UNICODE_STRING *)v6, *(UNICODE_STRING **)v6, v77, (WCHAR *)v72);
              LODWORD(v19) = v136;
              ValidPte = PteShadow;
              goto LABEL_179;
            }
            MiDiscardTransitionPteEx((UINT64)v57, 0i64);
            _InterlockedAnd64((volatile signed __int64 *)v57 + 3, 0x7FFFFFFFFFFFFFFFui64);
            v9 = (UINT64)PoINTerPte;
            goto LABEL_127;
          }
        }
        else
        {
LABEL_147:
          v70 = MiUnlinkPageFromList((_MMPFN *)v57, 0i64);
        }
        v72 = 0x7FFFFFFFFFFFFFFFi64;
        goto LABEL_149;
      }
LABEL_116:
      _InterlockedAnd64((volatile signed __int64 *)v57 + 3, 0x7FFFFFFFFFFFFFFFui64);
LABEL_195:
      v16 = 0i64;
LABEL_196:
      v95 = 0i64;
      goto LABEL_197;
    }
    v58 = (v57[35] & 0x40) == 0;
    ValidPte = v23;
    if( !v58 )
      goto LABEL_116;
    *((_QWORD *)v57 + 3) ^= (*((_QWORD *)v57 + 3) ^ (*((_QWORD *)v57 + 3) + 1i64)) & 0x3FFFFFFFFFFFFFFFi64;
LABEL_179:
    _InterlockedAnd64((volatile signed __int64 *)v57 + 3, 0x7FFFFFFFFFFFFFFFui64);
    v16 = 0i64;
    while( 1 )
    {
LABEL_210:
      v98 = KeGetCurrentIrql();
      __writecr8(2ui64);
      v11 = v127;
      LODWORD(v130) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)v11 + 6, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&v130);
        while( *((__int64 *)v11 + 3) < 0 );
      }
      CurrentPrcb = *((_QWORD *)v11 + 3);
      *((_QWORD *)v11 + 3) = CurrentPrcb ^ ((CurrentPrcb + 1) ^ CurrentPrcb) & 0x3FFFFFFFFFFFFFFFi64;
      _InterlockedAnd64((volatile signed __int64 *)v11 + 3, 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v98);
      if( (v19 & 1) != 0 )
      {
        v99 = MI_READ_PTE_LOCK_FREE((INT64)&ValidPte);
        v100 = MiMakeValidPte(v9, (v99 >> 12) & 0xFFFFFFFFFi64, 536870913i64);
      }
      else
      {
        v100 = ValidPte;
        if( (v120 & 4) != 0 && (ValidPte & 0x42) == 0 && (ValidPte & 0x800) != 0 )
          v100 = ValidPte | 0x42;
      }
      v95 = v100 & 0xFFFFFFFFFFFFFEFBui64 | ((unsigned __int64)(word_140C4DD48 & 1) << 8);
LABEL_197:
      v9 += 8i64;
      ValidPte = v95;
      if( (unsigned int)v19 >= 2 )
      {
        v95 &= ~1ui64;
        ValidPte = v95;
      }
      v5 = BatchCount;
      if( BatchCount || v95 )
      {
        v142[BatchCount] = v95;
        BatchCount = ++v5;
        if( v5 == 16 )
        {
          if( PageIrql != 17 )
          {
            MiUnlockProtoPoolPage(v7, PageIrql);
            PageIrql = 17;
          }
          MiMakeSystemCacheRangeValid((_MMPTE *)(v9 - 128), (_MMPTE *)v142, 0x10ui64, (_MMPFN *)v11);
          v5 = 0;
          BatchCount = 0;
        }
      }
      if( !v133 )
        break;
      v96 = *(_QWORD *)(v6 + 8);
      v6 += 8i64;
      --v133;
      ValidPte = v96;
      v97 = *(_QWORD *)v9;
      v134 = v97;
      LODWORD(v19) = 0;
      if( (v97 & 1) != 0 )
      {
        LODWORD(v19) = 2;
      }
      else if( (v97 & 8) != 0 )
      {
        LODWORD(v19) = 1;
      }
    }
    PoINTerPte = (_MMPTE *)v9;
  }
  if( PageIrql != 17 )
  {
    HIDWORD(v130) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)v7 + 6, 0x3Fui64) )
    {
      do
        KeYieldProcessorEx((UINT64 *)((char *)&v130 + 4));
      while( *((__int64 *)v7 + 3) < 0 );
    }
    *((_BYTE *)v7 + 34) &= ~0x20u;
    v101 = *((_WORD *)v7 + 16);
    if( !v101 )
      MiBadRefCount(v7, CurrentPrcb);
    v102 = v101 - 1;
    *((_WORD *)v7 + 16) = v102;
    if( !v102 && MiIsPfnFileOnly((INT64)v7) )
      goto LABEL_261;
    if( (unsigned int)MiAreChargesNeededToLockPage((INT64)v7) )
    {
      v104 = (WCHAR *)MmGetPteBase();
      v103 = (struct _KPRCB *)(v104 + 0x1FFFFFFFBCi64);
      v105 = (UNICODE_STRING *)(*((_QWORD *)v7 + 1) | 0x8000000000000000ui64);
      if( v105 > (UNICODE_STRING *)(v104 + 0x1FFFFFFFBCi64) || v105 < (UNICODE_STRING *)v104 )
      {
        v106 = *((_BYTE *)v7 + 35);
        if( (v106 & 0x20) != 0 )
        {
          *((_BYTE *)v7 + 35) = v106 & 0xDF;
          goto LABEL_260;
        }
      }
      LOBYTE(v107) = MI_PFN_IS_PROTO((UNICODE_STRING *)v7, v105, (UINT8)v103, v104);
      if( v107 && (*((_DWORD *)v7 + 4) & 0x400i64) != 0 )
      {
        v110 = 1i64;
        v111 = 1;
      }
      else if( v108 <= (unsigned __int64)v103 && v108 >= v109 && (*((_BYTE *)v7 + 35) & 0x20) != 0 )
      {
        v110 = 1i64;
        v111 = 1;
      }
      else
      {
        v110 = 1i64;
        if( v102 )
        {
          v111 = 0;
        }
        else
        {
          if( (*((_QWORD *)v7 + 3) & 0x4000000000000000i64) != 0 )
            v16 = 1i64;
          v128 = (_RTL_BITMAP_EX *)v16;
          v111 = v16;
        }
      }
      v112 = (*((_QWORD *)v7 + 5) >> 39) & 0x3FFi64;
      v113 = *(_QWORD *)(qword_140C4E388 + 8 * v112);
      if( v111 == 1 )
        MiReturnCommit(*(_MI_PARTITION **)(qword_140C4E388 + 8 * v112), 1ui64);
      if( (ULONG_PTR *)v113 != &MiSystemPartition )
        goto LABEL_258;
      v103 = KeGetCurrentPrcb();
      v114 = *((int *)v103 + 8391);
      if( (_DWORD)v114 == -1 )
        goto LABEL_258;
      if( (unsigned __int64)(v114 + 1) <= 0x100 )
      {
        do
        {
          v115 = _InterlockedCompareExchange((volatile signed __int32 *)v103 + 8391, v114 + 1, v114);
          v58 = (_DWORD)v114 == v115;
          LODWORD(v114) = v115;
          if( v58 )
            goto LABEL_259;
        }
        while( v115 != -1 && (unsigned __int64)(v115 + 1i64) <= 0x100 );
      }
      if( (int)v114 > 192
        && (_DWORD)v114 != -1
        && (_DWORD)v114 == _InterlockedCompareExchange((volatile signed __int32 *)v103 + 8391, 192, v114) )
      {
        v110 = (int)v114 - 192 + 1i64;
      }
      if( v110 )
LABEL_258:
        _InterlockedExchangeAdd64((volatile signed __int64 *)(v113 + 7168), v110);
LABEL_259:
      v5 = BatchCount;
LABEL_260:
      if( !v102 )
LABEL_261:
        MiPfnReferenceCountIsZero(v7, (v7 - MmGetPfnDb()) / 48, (UINT8 *)v103);
    }
    _InterlockedAnd64((volatile signed __int64 *)v7 + 3, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(PageIrql);
  }
  if( v5 )
    MiMakeSystemCacheRangeValid((_MMPTE *)(v9 - 8i64 * v5), (_MMPTE *)v142, v5, (_MMPFN *)v11);
  if( v140 )
    *v140 = BatchCount_4;
}

Referenced by: