MiFreePhysicalPages

INT64 __fastcall MiFreePhysicalPages(INT64 a1, INT64 a2){
  INT64 v3; 
  __int64 *v4; 
  unsigned int v5; 
  UINT64 v6; 
  _QWORD *v7; 
  unsigned __int64 v8; 
  _ETHREAD *CurrentThread; 
  INT64 v10; 
  unsigned __int64 v11; 
  const signed __int64 *v12; 
  _MMPTE *PteBase; 
  __int64 v14; 
  unsigned __int64 v15; 
  char *v16; 
  VOID *v17; 
  unsigned __int64 v18; 
  UINT64 v19; 
  VOID *v20; 
  UINT8 v21; 
  char v22; 
  INT64 v23; 
  INT64 v24; 
  int v25; 
  INT64 v26; 
  INT64 a5; 
  INT64 a6; 
  UINT64 CommitSize; 
  unsigned __int64 v30; 
  signed __int64 *v31; 
  _ETHREAD *v32; 
  unsigned __int64 v33; 
  __int64 v35; 
  unsigned __int64 v36; 
  unsigned __int64 v37; 
  ULONG_PTR BugCheckParameter2; 
  int result; 
  __int16 result_4; 
  int v41; 
  __int64 v42; 
  __int64 v43; 
  v3 = a1;
  memset((INT64)&result, 0i64);
  result = 1;
  result_4 = 0;
  v4 = (__int64 *)(a2 + 48);
  v42 = 0i64;
  v5 = 0;
  v43 = 0i64;
  v6 = 0i64;
  LODWORD(a6) = 0;
  v7 = (_QWORD *)(a2 + 48);
  v8 = (unsigned __int64)*(unsigned int *)(a2 + 40) >> 12;
  v41 = 20;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  LOBYTE(a5) = 17;
  v32 = CurrentThread;
  v30 = a2 + 48 + 8 * v8;
  v33 = *(_QWORD *)(v3 + 8);
  v10 = *((_QWORD *)CurrentThread + 23) + 1664i64;
  HIDWORD(a6) = *(_DWORD *)v3 & 1;
  if( HIDWORD(a6) )
    MiLockAweVadsExclusive((INT64)CurrentThread);
  --*((_WORD *)CurrentThread + 243);
  BugCheckParameter2 = v3 + 56;
  ExAcquireAutoExpandPushLockExclusive(v3 + 56, 0i64);
  v11 = *(_QWORD *)(v3 + 16);
  v12 = *(const signed __int64 **)(v3 + 24);
  v37 = v11;
  v31 = (signed __int64 *)v12;
  if( (unsigned __int64)v4 < v30 )
  {
    PteBase = MmGetPteBase();
    while( 1 )
    {
      v35 = *v4;
      v14 = *v4;
      v15 = *v4 / v33;
      v36 = v15;
      if( *v4 % v33 )
        break;
      if( v15 >= v11 )
        break;
      if( !_bittest64(v12, v15) )
        break;
      v16 = (char *)MmGetPfnDb() + 48 * v35;
      CommitSize = (UINT64)v16;
      if( (*((_QWORD *)v16 + 3) & 0x4000000000000000i64) != 0 )
        break;
      v17 = (VOID *)(*((_QWORD *)v16 + 3) & 0x3FFFFFFFFFFFFFFFi64);
      if( v17 != (VOID *)1 && (*(_DWORD *)v3 & 1) != 0 )
      {
        v18 = *((_QWORD *)v16 + 1);
        v19 = (UINT64)PteBase + ((v18 >> 9) & 0x7FFFFFFFF8i64);
        if( v6 != v19 )
        {
          if( v6 )
          {
            MiFlushTbList((__int64)&result);
            MiUnlockPageTableInternal(v10, v6);
          }
          v6 = v19;
          if( (_BYTE)a5 == 17 )
            LOBYTE(a5) = MiLockWorkingSetShared(v10);
          MiLockPageTableInternal(v10, v19, 0i64);
        }
        HIDWORD(a5) = 0;
        *(_QWORD *)v18 = ZeroPte;
        MiUpdateAwePageTable(v6, -1i64, 0xFFFFFFFFi64);
        MiInsertTbFlushEntry((INT64)&result, (__int64)((v18 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16, 1i64, 0i64);
        MiDecrementAweMapCount(v20, CommitSize, (UINT64)MmBadPointer);
        v16 = (char *)CommitSize;
        v3 = a1;
        v14 = v35;
      }
      if( !MiDecrementAweMapCount(v17, (UINT64)v16, (UINT64)MmBadPointer) )
      {
        *v7++ = v14;
        _bittestandreset64(v31, v36);
      }
      v21 = a5;
      v22 = a6 + 1;
      LODWORD(a6) = a6 + 1;
      if( (_BYTE)a5 != 17 && (v22 & 0x3F) == 0 )
      {
        if( MiWorkingSetIsContended(v10)
          || (MiPageTableLockIsContended(v10, v6, v23, v24, a5, a6, CommitSize), v25)
          || KeShouldYieldProcessor() )
        {
          MiFlushTbList((__int64)&result);
          MiUnlockPageTableInternal(v10, v6);
          MiUnlockWorkingSetShared(v10, v21);
          v6 = 0i64;
          LOBYTE(a5) = 17;
        }
      }
      v12 = v31;
      ++v4;
      v11 = v37;
      PteBase = MmGetPteBase();
      if( (unsigned __int64)v4 >= v30 )
        goto LABEL_29;
    }
    v5 = -1073741800;
LABEL_29:
    if( v6 )
    {
      MiFlushTbList((__int64)&result);
      MiUnlockPageTableInternal(v10, v6);
      MiUnlockWorkingSetShared(v10, a5);
    }
    CurrentThread = v32;
  }
  ExReleaseAutoExpandPushLockExclusive(BugCheckParameter2, 0i64);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( HIDWORD(a6) )
    MiUnlockAweVadsExclusive((__int64)CurrentThread);
  v26 = v5;
  *(_DWORD *)(a2 + 44) = ((__int64)v4 - a2 - 48) >> 3;
  *(_DWORD *)(a2 + 40) = ((__int64)v7 - a2 - 48) >> 3;
  return v26;
}

Referenced by: