MiInsertProtectedStandbyPage

VOID __fastcall MiInsertProtectedStandbyPage(INT64 a1, UINT64 a2){
  _MMPFN *PfnDb; 
  unsigned __int64 v5; 
  UINT8 *v6; 
  __int64 v7; 
  __int64 v8; 
  UINT64 v9; 
  __int64 v10; 
  __int64 v11; 
  INT64 v12; 
  KSPIN_LOCK_QUEUE *v13; 
  int v14; 
  WORK_QUEUE_TYPE v15; 
  void *v16; 
  __int64 v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  struct _KEVENT *v20; 
  unsigned __int64 v21; 
  char v22; 
  unsigned __int64 v23; 
  __int64 v24; 
  unsigned __int64 v25; 
  __int64 v26; 
  unsigned __int64 *v27; 
  _KSPIN_LOCK_QUEUE *volatile Next; 
  int v29[8]; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  _BYTE v31[64]; 
  PfnDb = MmGetPfnDb();
  memset(&LockHandle, 0, sizeof(LockHandle));
  v5 = *(_QWORD *)(a2 + 40);
  v6 = (UINT8 *)(a2 - (_QWORD)PfnDb);
  v7 = 0x2AAAAAAAAAAAAAABi64;
  v8 = (unsigned __int128)((__int64)(a2 - (_QWORD)PfnDb) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
  v9 = ((unsigned __int64)v8 >> 63) + (v8 >> 3);
  if( (v5 & 0x2000000000000i64) != 0 || byte_140C51D9E && _bittest64((const signed __int64 *)qword_140C522C8, v9 >> 9) )
    goto LABEL_13;
  if( !a1 )
    goto LABEL_13;
  v6 = (UINT8 *)*(unsigned __int8 *)(a2 + 35);
  if( ((unsigned __int8)v6 & 0x10) != 0 )
    goto LABEL_13;
  if( ((unsigned __int8)v6 & 0x40) != 0 )
    goto LABEL_13;
  v10 = *(_QWORD *)(qword_140C4E388 + 8 * ((v5 >> 39) & 0x3FF));
  if( *(_QWORD *)(qword_140C4E388 + 8 * ((*(_QWORD *)(a1 + 40) >> 39) & 0x3FFi64)) != v10
    || ((unsigned __int8)v6 & 7u) >= 5 )
  {
    goto LABEL_13;
  }
  LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)(v10 + 2664);
  LockHandle.LockQueue.Next = 0i64;
  v11 = *((_QWORD *)KeGetCurrentPrcb() + 4247);
  v12 = (a1 - (__int64)PfnDb) / 48;
  v13 = (KSPIN_LOCK_QUEUE *)_InterlockedExchange64((volatile __int64 *)(v10 + 2664), (__int64)&LockHandle);
  if( v13 )
    KxWaitForLockOwnerShip(&LockHandle.LockQueue, v13);
  if( (*(_BYTE *)(a1 + 35) & 8) == 0 )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
LABEL_13:
    MiPfnReferenceCountIsZero((_MMPFN *)a2, v9, v6);
    return;
  }
  *(_BYTE *)(a2 + 35) |= 8u;
  LOBYTE(v14) = MI_PFN_IS_PROTO((UNICODE_STRING *)a2, (UNICODE_STRING *)v13, v11, (PWCHAR)v7);
  v17 = 4352i64;
  if( !v14 )
    v17 = 5056i64;
  _InterlockedIncrement64((volatile signed __int64 *)(v17 + v10));
  memset(v31, 0, 24);
  v18 = _InterlockedIncrement64((volatile signed __int64 *)(v10 + 7104));
  if( v18 <= 0x420 )
  {
    switch( v18 )
    {
      case 0xA0ui64:
        v19 = 4968i64;
LABEL_23:
        *(_QWORD *)v31 = 0i64;
        *(_QWORD *)&v31[8] = v10 + 4928;
        v20 = (struct _KEVENT *)(v10 + v19);
        KxAcquireQueuedSpinLock((PIO_WORKITEM)v31, (PIO_WORKITEM_ROUTINE)(v10 + 4928), v15, v16);
        KeSetEvent(v20, 0);
        ++v20[1].Header.LockNV;
        KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)v31);
        break;
      case 0x420ui64:
        v19 = 5000i64;
        goto LABEL_23;
      case 0x22ui64:
        v19 = 4936i64;
        goto LABEL_23;
    }
  }
  v21 = v18 - 1;
  if( v21 == *(_QWORD *)(v10 + 5168) || v21 == *(_QWORD *)(v10 + 5176) )
    MiUpdateAvailableEvents((_MI_PARTITION *)v10);
  _InterlockedOr(v29, 0);
  v22 = *(_BYTE *)(a2 + 34);
  *(_QWORD *)(a2 + 24) ^= (*(_QWORD *)(a2 + 24) ^ ((unsigned __int64)(unsigned int)KiTbFlushTimeStamp << 56)) & 0xF00000000000000i64;
  *(_BYTE *)(a2 + 34) = v22 & 0xF8 | 2;
  v23 = *(_QWORD *)(a1 + 16);
  if( qword_140C4DC80 && (v23 & 0x10) == 0 )
    v23 &= ~qword_140C4DC80;
  v24 = *(_QWORD *)(a1 + 40) & 0xFFFFFFFFFi64;
  v25 = 0xFFFFFFF000000000ui64;
  *(_QWORD *)a2 ^= (v12 ^ *(_QWORD *)a2) & 0xFFFFFFFFFi64;
  v26 = v9 & 0xFFFFFFFFFi64;
  *(_QWORD *)(a2 + 24) = v24 | *(_QWORD *)(a2 + 24) & 0xFFFFFFF000000000ui64;
  if( ((v23 >> 12) & 0xFFFFFFFFFi64) == v12 )
  {
    *(_QWORD *)(a1 + 16) = MiMakeTransitionPte(v9, 4ui64, v26);
  }
  else
  {
    v27 = (unsigned __int64 *)((char *)MmGetPfnDb() + 48 * v24);
    *v27 = v26 | *v27 & 0xFFFFFFF000000000ui64;
  }
  *(_QWORD *)(a1 + 40) = v26 | v25 & *(_QWORD *)(a1 + 40);
  MiInsertNumaStandbyPage((_MMPFN *)a2);
  ++*(_QWORD *)(v10 + 2632);
  _m_prefetchw(&LockHandle);
  Next = LockHandle.LockQueue.Next;
  if( !LockHandle.LockQueue.Next )
  {
    if( (struct _KLOCK_QUEUE_HANDLE *)_InterlockedCompareExchange64(
                                         (volatile signed __int64 *)LockHandle.LockQueue.Lock,
                                         0i64,
                                         (signed __int64)&LockHandle) == &LockHandle )
      return;
    Next = KxWaitForLockChainValid(&LockHandle.LockQueue);
  }
  LockHandle.LockQueue.Next = 0i64;
  _InterlockedXor64((volatile signed __int64 *)&Next->Lock, 1ui64);
}

Referenced by: