MiWalkEntireImage

NTSTATUS __stdcall MiWalkEntireImage(_CONTROL_AREA *ControlArea, VOID *Opaque, INT64 Flags, UINT64 SessionId){
  _CONTROL_AREA *SeImageStub; 
  _CONTROL_AREA *v5; 
  _SEGMENT *Segment; 
  char v7; 
  unsigned int v8; 
  __int64 v9; 
  union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v10; 
  INT64 v11; 
  _SUBSECTION *v12; 
  __int64 v13; 
  __int64 v14; 
  int v15; 
  _MMPFN *v16; 
  _ETHREAD *CurrentThread; 
  _MMPFN *v18; 
  _MMPTE v19; 
  _MMPTE v20; 
  _MMPFN *v21; 
  unsigned __int64 SubsectionBase; 
  __int64 v23; 
  UINT64 v24; 
  bool v25; 
  UINT64 v26; 
  INT64 *v27; 
  unsigned __int64 v28; 
  int v29; 
  _MMPFN *v30; 
  UINT64 v31; 
  UINT64 v32; 
  void *v33; 
  int v34; 
  char v35; 
  int v36; 
  int v37; 
  unsigned int v38; 
  UINT8 v39; 
  unsigned __int64 EntireField; 
  _CONTROL_AREA *v41; 
  NTSTATUS updated; 
  _MMPFN *v43; 
  _MI_PARTITION *v44; 
  _MMPTE v45; 
  __int64 CurrentIrql; 
  PVOID v47; 
  _MMPFN *v48; 
  UINT64 v49; 
  UINT8 v50; 
  NTSTATUS result; 
  _CONTROL_AREA *v52; 
  unsigned __int64 v53; 
  INT64 v54; 
  int v55; 
  _EX_PUSH_LOCK *v56; 
  _CONTROL_AREA *v57; 
  _MMPFN *v58; 
  _CONTROL_AREA *v59; 
  _MMPFN *v60; 
  _RTL_BALANCED_NODE *SharedProtos; 
  __int64 v62; 
  UINT64 v63; 
  unsigned int EffectivePagePriorityThread; 
  _LARGE_INTEGER v65; 
  UINT64 v66; 
  int v67; 
  __int64 v68; 
  void *v69; 
  NTSTATUS v70; 
  NTSTATUS v71; 
  __int64 v72; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v73; 
  unsigned int v74; 
  _MMPFN *v75; 
  INT64 v76; 
  unsigned __int64 v77; 
  __int64 v78; 
  _MMPFN *v79; 
  _MMPFN *v80; 
  UINT64 Diff; 
  UINT64 DesiredProtection; 
  UINT64 *PageFrameIndex; 
  UINT8 PageIrql[4]; 
  NTSTATUS v85; 
  int v86; 
  UINT64 ImagePteIndex; 
  __int64 v88; 
  UINT64 SessionIda; 
  _CONTROL_AREA *ControlAreaa; 
  UINT64 FileOffset; 
  PVOID LockedPfns; 
  unsigned __int64 v93; 
  _MMPFN *Pfn1; 
  int v95; 
  _DWORD Flagsa[3]; 
  _SUBSECTION *Subsection; 
  UINT64 v98; 
  UINT8 WsIrql[4]; 
  int v100; 
  _CONTROL_AREA *v101; 
  unsigned __int64 v102; 
  INT64 v103; 
  _MMPFN *LastPfn; 
  _MMPFN *DecayPfn; 
  UINT64 SpinCount; 
  UINT64 v107; 
  unsigned __int64 v108; 
  unsigned __int64 v109; 
  VOID *Opaquea; 
  __int64 v111; 
  _ETHREAD *Thread; 
  _EX_PUSH_LOCK *v113; 
  _EPROCESS *CallingProcess; 
  _SUBSECTION *NextSubsection; 
  _MI_COLOR_BASE ColorBase[4]; 
  _MMPFN v117[3]; 

  SeImageStub = (_CONTROL_AREA *)ControlArea->u2.SeImageStub;
  v5 = ControlArea;
  Segment = ControlArea->Segment;
  ControlAreaa = ControlArea;
  v7 = Flags;
  v8 = 0;
  v9 = ControlArea->u1.Flags._bf_0 & 0x3FF;
  Opaquea = Opaque;
  v10.LongFlags = (unsigned int)v5->u;
  v86 = Flags;
  LODWORD(SessionIda) = SessionId;
  v11 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8 * v9);
  *(_DWORD *)WsIrql = 0;
  v98 = 0i64;
  v101 = SeImageStub;
  v113 = (_EX_PUSH_LOCK *)Segment;
  v103 = v11;
  v95 = Flags & 8;
  *(_OWORD *)ColorBase = 0i64;
  if( (v10.LongFlags & 0x40000000) == 0 || (Flags & 8) != 0 )
  {
    v95 = Flags & 8;
    if( (v10.LongFlags & 0x800) == 0 )
      goto LABEL_3;
    v95 = Flags & 8;
  }
  v8 = 2;
LABEL_3:
  if( (Flags & 8) != 0 )
  {
    MiInitializePageColorBase((_MMSUPPORT_INSTANCE *)(v11 + 7424), (v10.LongFlags >> 20) & 0x3F, ColorBase);
    LODWORD(v58) = MiGetNextDirectFixupProto(v57, 0i64);
    v102 = v58->PteLong | 0x8000000000000000ui64;
    LODWORD(v60) = MiGetNextDirectFixupProto(v59, v58);
    v10.LongFlags = (unsigned int)v5->u;
    LODWORD(SessionId) = SessionIda;
    LastPfn = v60;
  }
  else
  {
    v102 = 0i64;
    LastPfn = 0i64;
  }
  v12 = (_SUBSECTION *)&v5[1];
  v13 = *(_QWORD *)v5[1].gap8;
  v14 = -1i64;
  Subsection = (_SUBSECTION *)&v5[1];
  v15 = 0;
  *(_QWORD *)&Flagsa[1] = v13;
  v16 = 0i64;
  CallingProcess = KeGetCurrentThread()->ApcState.Process;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Thread = CurrentThread;
  PageIrql[0] = 17;
  v85 = 0;
  Pfn1 = 0i64;
  DecayPfn = 0i64;
  v88 = -1i64;
  Flagsa[0] = 0;
  if( (v10.LongFlags & 0x4000000) != 0 )
  {
    v8 |= 4u;
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockSharedEx(&Segment->SegmentLock, 0i64);
    v5 = ControlAreaa;
    v14 = v88;
    v13 = *(_QWORD *)&Flagsa[1];
    LODWORD(SessionId) = SessionIda;
    SeImageStub = v101;
    Flagsa[0] = 0x20000;
  }
  if( (MiFlags & 0x4000) != 0
    && (v5->u2.WritableUserReferences & 0xC0000) != 0
    && !*(_QWORD *)&SeImageStub->u.LongFlags )
  {
    result = MiGetSectionStrongImageReference((INT64)SeImageStub);
    v85 = result;
    v15 = result;
    if( result >= 0 )
    {
      v14 = v88;
      v13 = *(_QWORD *)&Flagsa[1];
      goto LABEL_28;
    }
    return result;
  }
  while( 2 )
  {
    SubsectionBase = (unsigned __int64)v12->SubsectionBase;
    NextSubsection = v12->NextSubsection;
    v23 = (__int64)(SubsectionBase - v13) >> 3;
    v25 = (v12->u.SubsectionFlags._bf_2 & 2) == 0;
    v93 = SubsectionBase;
    ImagePteIndex = v23;
    if( !v25 )
    {
      if( (v7 & 1) != 0 )
        goto LABEL_27;
      if( (v5->u.LongFlags & 0x4000000) != 0 )
      {
        if( (v7 & 0xA) != 0 || !v12->GlobalPerSessionHead.Root )
          goto LABEL_27;
        SharedProtos = MiGetSharedProtos(v5, (unsigned int)SessionId, v12);
        if( !SharedProtos )
        {
LABEL_215:
          v14 = v88;
          goto LABEL_26;
        }
        SubsectionBase = (unsigned __int64)SharedProtos[3].Children[0];
        LODWORD(SessionId) = SessionIda;
        v93 = SubsectionBase;
      }
    }
    LODWORD(v26) = MiStartingOffset(v12, (_MMPTE *)SubsectionBase, (unsigned int)SessionId);
    v24 = v26;
    FileOffset = v26;
    v28 = SubsectionBase + 8i64 * Subsection->PtesInSubsection;
    v108 = v28;
    if( v102 )
    {
      if( v102 >= v28 )
        goto LABEL_215;
      v62 = v102 - SubsectionBase;
      SubsectionBase = v102;
      v62 >>= 3;
      v23 = (unsigned int)(v62 + v23);
      v93 = v102;
      v24 += v62 << 12;
      ImagePteIndex = v23;
      FileOffset = v24;
    }
    v18 = 0i64;
    v109 = 0i64;
    if( SubsectionBase >= v28 )
      goto LABEL_22;
LABEL_11:
    if( (SubsectionBase & 0xFFF) != 0 )
    {
      if( v16 )
        goto LABEL_13;
    }
    else if( v16 )
    {
      MiUnlockProtoPoolPage((ULONG_PTR)v16, PageIrql[0]);
    }
    if( (v8 & 2) != 0 )
      v30 = MiLockProtoPoolPage((_MMPTE *)SubsectionBase, PageIrql);
    else
      v30 = MiCheckProtoPtePageState((VOID *)SubsectionBase, PageIrql);
    Pfn1 = v30;
    v16 = v30;
    if( !v30 )
    {
      if( (v8 & 2) != 0 )
      {
        MmAccessFault(2ui64, (PVOID)SubsectionBase, 0, 0i64);
        goto LABEL_21;
      }
      v53 = (unsigned __int64)(4096 - (unsigned int)(SubsectionBase & 0xFFF)) >> 3;
      v24 += v53 << 12;
      v23 = (unsigned int)(v53 + v23);
      SubsectionBase += 8 * v53;
      ImagePteIndex = v23;
      goto LABEL_19;
    }
    v18 = 0i64;
    while( 1 )
    {
LABEL_13:
      while( 1 )
      {
        v19.u.Long = *(_QWORD *)SubsectionBase;
        v20.u.Long = *(_QWORD *)SubsectionBase;
        if( (*(_QWORD *)SubsectionBase & 1) == 0 )
          break;
LABEL_37:
        v27 = (INT64 *)(6 * ((v20.u.Long >> 12) & 0xFFFFFFFFFi64));
        if( (MmGetPfnDb()[(v20.u.Long >> 12) & 0xFFFFFFFFFi64].u4._bf_0 & 0x4000000000000i64) != 0 )
        {
          v21 = &MmGetPfnDb()[(v20.u.Long >> 12) & 0xFFFFFFFFFi64];
          LODWORD(SpinCount) = (_DWORD)v18;
          if( _interlockedbittestandset64((volatile signed __int32 *)&v21->u2, 0x3Fui64) )
          {
            do
            {
              do
                KeYieldProcessorEx(&SpinCount);
              while( v21->u2._bf_0 < 0 );
            }
            while( _interlockedbittestandset64((volatile signed __int32 *)&v21->u2, 0x3Fui64) );
            v18 = 0i64;
          }
          if( *(_QWORD *)SubsectionBase == v19.u.Long )
            goto LABEL_16;
          _InterlockedAnd64(&v21->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
        }
      }
      if( (*(_QWORD *)SubsectionBase & 0xC00i64) != 2048 )
        break;
      LOBYTE(v29) = MiInvalidPteConforms(*(_QWORD *)SubsectionBase, v27);
      if( v29 )
      {
        v20.u.Long = v19.u.Long;
        if( *(&stru_140C4DB30 + 42) && (v19.u.Long & 0x10) == 0 )
          v20.u.Long = v19.u.Long & ~*(&stru_140C4DB30 + 42);
        goto LABEL_37;
      }
    }
    v21 = v18;
LABEL_16:
    LockedPfns = v21;
    if( !v21 )
    {
      if( (v8 & 2) == 0 )
        goto LABEL_18;
      LODWORD(v63) = MI_READ_PTE_LOCK_FREE(SubsectionBase);
      v98 = v63;
      if( (v63 & 0x400) != 0 )
        goto LABEL_18;
      if( !MiGetPagingFileOffset((_MMPTE *)&v98) )
        goto LABEL_18;
      MiUnlockProtoPoolPage((ULONG_PTR)v16, PageIrql[0]);
      Pfn1 = 0i64;
      if( (v7 & 2) != 0 && !MiPageHasRelocations(v101, (unsigned int)v23) )
        goto LABEL_18;
      EffectivePagePriorityThread = MiGetEffectivePagePriorityThread(Thread);
      if( EffectivePagePriorityThread > 5 )
        EffectivePagePriorityThread = 5;
      if( SubsectionBase == v109 )
      {
        v66 = 4096i64;
      }
      else
      {
        v109 = SubsectionBase;
        v66 = (__int64)(v108 - SubsectionBase) >> 3 << 12;
      }
      LODWORD(DesiredProtection) = SessionIda;
      LODWORD(Diff) = 2;
      if( MiPrefetchControlArea(ControlAreaa, v65, v66, EffectivePagePriorityThread, Diff, DesiredProtection) < 0 )
        KeDelayExecutionThread(0, 0, (_LARGE_INTEGER *)&Interval);
      v15 = 0;
      v85 = 0;
      v24 = FileOffset;
LABEL_21:
      v16 = Pfn1;
      if( SubsectionBase >= v108 )
      {
LABEL_22:
        if( v16 )
        {
          MiUnlockProtoPoolPage((ULONG_PTR)v16, PageIrql[0]);
          v16 = 0i64;
          Pfn1 = 0i64;
        }
LABEL_24:
        v14 = v88;
        if( v88 != -1 )
        {
          v79 = &MmGetPfnDb()[v88];
          LockedPfns = v79;
          PageIrql[0] = MiLockPageInline(v79);
          MiFreeSlabPage((INT64)v79);
          _InterlockedAnd64(&v79->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
          __writecr8(PageIrql[0]);
          v14 = -1i64;
          v88 = -1i64;
        }
LABEL_26:
        v13 = *(_QWORD *)&Flagsa[1];
LABEL_27:
        Subsection = NextSubsection;
        v12 = NextSubsection;
        if( !NextSubsection )
          goto LABEL_113;
LABEL_28:
        LODWORD(SessionId) = SessionIda;
        v5 = ControlAreaa;
        continue;
      }
      v18 = 0i64;
      goto LABEL_11;
    }
    break;
  }
  v31 = *(_QWORD *)SubsectionBase;
  MiPteInShadowRange(SubsectionBase);
  v98 = v31;
  v32 = v31 & 1;
  if( (v31 & 1) != 0 )
  {
    MiPteInShadowRange((UINT64)&v98);
  }
  else if( *(&stru_140C4DB30 + 42) && (v31 & 0x10) == 0 )
  {
    v31 &= ~*(&stru_140C4DB30 + 42);
  }
  v33 = (void *)((v31 >> 12) & 0xFFFFFFFFFi64);
  if( (v7 & 4) != 0 )
  {
    MiIsPfnSystemCharged((INT64)v21);
    if( v55 )
    {
      MiDriverPageIsDangling(v54);
      *((_BYTE *)&v21->u3 + 3) &= ~0x20u;
    }
    _InterlockedAnd64(&v21->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
LABEL_18:
    LODWORD(ImagePteIndex) = ImagePteIndex + 1;
    SubsectionBase += 8i64;
    LODWORD(v23) = ImagePteIndex;
    v24 = FileOffset + 4096;
    v15 = v85;
LABEL_19:
    v93 = SubsectionBase;
    goto LABEL_20;
  }
  v34 = v7 & 1;
  if( v34 && (((unsigned __int64)v21->u4._bf_0 >> 60) & 7) == 3 )
  {
    _InterlockedAnd64(&v21->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    v7 = v86;
    goto LABEL_18;
  }
  if( (*(_DWORD *)(&v21->3 + 1) & 0x400i64) == 0 && (v8 & 2) == 0
    || (v35 = *((_BYTE *)&v21->u3 + 3), (v35 & 0x10) != 0) )
  {
    _InterlockedAnd64(&v21->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    goto LABEL_103;
  }
  if( !v32 && (*(_BYTE *)(&v21->u3 + 1) & 0x20) != 0 )
  {
    memset(v117, 0i64, 0x88u);
    v7 = v86;
    if( (ControlAreaa->u.LongFlags & 2) != 0 || (v86 & 2) == 0 )
    {
      MiInitializePageFaultPacket(0i64, 0i64, 0, 0i64, (INT64)v117);
      *(_DWORD *)WsIrql = 1;
      MiObtainProtoReference(v16, 1ui64);
      MiWaitForCollidedFaultComplete(
        v117,
        v21,
        v16,
        (_MMSUPPORT_INSTANCE *)PageIrql[0],
        (UINT8)WsIrql,
        DesiredProtection,
        PageFrameIndex);
      LODWORD(v23) = ImagePteIndex;
      v24 = FileOffset;
      v15 = 0;
      Pfn1 = 0i64;
      v85 = 0;
      goto LABEL_21;
    }
    MiDeleteTransitionPte((_MMPTE *)SubsectionBase, v21, 0x11u, 1ui64);
    goto LABEL_18;
  }
  v36 = 8;
  v100 = 8;
  if( !v32 )
  {
    if( (v35 & 8) != 0 )
    {
      v36 = v35 & 7;
      v100 = v36;
    }
    MiUnlinkPageFromList(v21, 0i64);
    if( v37 )
    {
      v21->u2._bf_0 &= 0xC000000000000000ui64;
      goto LABEL_62;
    }
    MiDiscardTransitionPteEx(v21, 0i64);
    _InterlockedAnd64(&v21->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    SubsectionBase = v93;
    if( (v8 & 2) != 0 )
    {
      v15 = v85;
      v7 = v86;
      LODWORD(v23) = ImagePteIndex;
      v24 = FileOffset;
      goto LABEL_21;
    }
LABEL_103:
    v7 = v86;
    goto LABEL_18;
  }
LABEL_62:
  if( !v34
    || !(unsigned int)MiUseSlabAllocator(v103, Subsection, v21->OriginalPte.u.Long, 0i64)
    || (LOBYTE(v67) = MiIsPfnFromSlabAllocation((INT64)v21),
        v67 && MiCheckSlabPage((INT64)v21, 0i64, (*(unsigned __int16 *)(v68 + 32) >> 1) & 0x1F)) )
  {
    v38 = v8 & 0xFFFFFFEF;
  }
  else
  {
    v38 = v8 | 0x10;
  }
  if( !MiAreChargesNeededToLockPage(v21) || MiChargeForLockedPage(v21, 1ui64) )
    ++v21->u3.ReferenceCount;
  _InterlockedAnd64(&v21->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  HIDWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)&v16->u2, 0x3Fui64) )
  {
    do
      KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
    while( v16->u2._bf_0 < 0 );
  }
  *((_BYTE *)&v16->u3 + 2) &= ~0x20u;
  if( MiRemoveLockedPageCharge(v16) )
    MiPfnReferenceCountIsZero(v16, v16 - MmGetPfnDb(), v39);
  _InterlockedAnd64(&v16->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  if( PageIrql[0] != 17 )
    __writecr8(PageIrql[0]);
  EntireField = v21->u4.EntireField;
  Pfn1 = 0i64;
  if( (EntireField & 0x2000000000000i64) != 0 )
    v8 = v38 | 1;
  else
    v8 = v38 & 0xFFFFFFFE;
  if( v95 )
  {
    if( MiPageHasRelocations(v101, (unsigned int)ImagePteIndex) )
    {
      LODWORD(v69) = MiSplitDirectMapPage(Subsection, ColorBase, (UINT64)v33);
      v33 = v69;
      v21->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 ^= (v21->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 ^ ((unsigned __int64)LastPfn >> 3)) & 0xFFFFFFFFFFEi64;
      v43 = &MmGetPfnDb()[(_QWORD)v69];
      LockedPfns = v43;
    }
  }
  else if( (v86 & 2) != 0 )
  {
    v41 = ControlAreaa;
    if( (MiFlags & 0x4000) != 0
      && (ControlAreaa->u2.WritableUserReferences & 0xC0000) != 0
      && ((EntireField >> 60) & 7) == 3 )
    {
      v70 = VslApplySecureImageFixups(*(_QWORD *)&v101->u.LongFlags, (unsigned int)ImagePteIndex, (INT64)v33);
      v85 = v70;
      if( v70 < 0 )
        KeBugCheckEx(0x1Au, (PVOID)0xD8A18, (PVOID)v70, v33, v41);
      goto LABEL_80;
    }
    LODWORD(PageFrameIndex) = 4;
    updated = MiRelocateImagePfn(
                ControlAreaa,
                Opaquea,
                (unsigned int)ImagePteIndex,
                (UINT64)v33,
                0i64,
                DesiredProtection);
    v85 = updated;
    if( !updated )
    {
      v8 |= 8u;
      goto LABEL_80;
    }
LABEL_78:
    if( updated == 1 )
      v85 = 0;
  }
  else
  {
    if( (v86 & 0x10) == 0 )
    {
      LODWORD(DesiredProtection) = ((unsigned __int16)Subsection->u.SubsectionFlags._bf_0 >> 1) & 0x1F;
      v85 = MiValidateImagePfn(
              ControlAreaa,
              FileOffset,
              CallingProcess,
              (unsigned int)ImagePteIndex,
              Diff,
              DesiredProtection,
              (UINT64)v33);
      goto LABEL_80;
    }
    v52 = ControlAreaa;
    if( (MiFlags & 0x4000) == 0
      || (ControlAreaa->u2.WritableUserReferences & 0xC0000) == 0
      || ((EntireField >> 60) & 7) != 3 )
    {
      updated = MiUpdateImagePfnImportRelocations(
                  (INT64)ControlAreaa,
                  (UINT64)Opaquea,
                  (unsigned int)ImagePteIndex,
                  (INT64)v33);
      v85 = updated;
      if( !updated )
      {
        v8 |= 8u;
        goto LABEL_80;
      }
      goto LABEL_78;
    }
    v71 = VslApplySecureImageFixups(*(_QWORD *)&v101->u.LongFlags, (unsigned int)ImagePteIndex, (INT64)v33);
    v85 = v71;
    if( v71 < 0 )
      KeBugCheckEx(0x1Au, (PVOID)0xD9A18, (PVOID)v71, v33, v52);
  }
LABEL_80:
  if( v36 != 8 && !DecayPfn && (v8 & 1) == 0 )
    DecayPfn = MiCreateDecayPfn((UINT64)v43);
  if( (v8 & 0x10) != 0 && v88 == -1 )
  {
    LODWORD(Diff) = Flagsa[0];
    LODWORD(v72) = MiGetSlabPage(
                     v103,
                     ((unsigned __int16)Subsection->u.SubsectionFlags._bf_0 >> 1) & 0x1F,
                     0i64,
                     (INT64 *)0xFFFFFFFFFFFFFFFFi64,
                     Diff);
    v88 = v72;
    if( v72 == -1 )
      v8 &= ~0x10u;
  }
  v44 = 0i64;
  v45.u.Long = 0i64;
  CurrentIrql = KeGetCurrentIrql();
  v111 = CurrentIrql;
  __writecr8(2ui64);
  LODWORD(v107) = 0;
  v47 = LockedPfns;
  while( _interlockedbittestandset64((volatile signed __int32 *)v47 + 6, 0x3Fui64) )
  {
    do
      KeYieldProcessorEx(&v107);
    while( *((__int64 *)v47 + 3) < 0 );
  }
  PageIrql[0] = CurrentIrql;
  if( (v8 & 0x10) != 0 && (*((_QWORD *)v47 + 3) & 0x4000000000000000i64) != 0 )
    v8 &= ~0x10u;
  v48 = (_MMPFN *)LockedPfns;
  if( (v86 & 2) != 0 )
  {
    v49 = *((_QWORD *)LockedPfns + 2);
    MiPteInShadowRange((UINT64)LockedPfns + 16);
    v98 = v49;
    if( (v49 & 0x400) != 0 )
    {
      v44 = 0i64;
    }
    else
    {
      MiCaptureDirtyBitToPfn();
      v45.u.Long = v73.Long;
      v44 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)v48->u4._bf_0 >> 39) & 0x3FF));
    }
    LOBYTE(CurrentIrql) = v111;
  }
  if( (v8 & 0x10) != 0 && (*(_BYTE *)(&v48->u3 + 1) & 7) == 6 )
  {
    MiTrimSharedPage(v48, CurrentIrql, Flagsa[0]);
    if( (*((_QWORD *)v47 + 3) & 0x4000000000000000i64) != 0 )
      v8 &= ~0x10u;
  }
  if( MiRemoveLockedPageCharge(v48) )
  {
    if( (v8 & 1) != 0
      || v100 == 8
      || (*(_BYTE *)(&v48->u3 + 1) & 0x10) != 0
      || _bittest64((const signed __int64 *)v47 + 3, 0x3Eu)
      || (v8 & 0x10) != 0 )
    {
      MiPfnReferenceCountIsZero(v48, (UINT64)v33, v50);
    }
    else
    {
      MiInsertAndUnlockStandbyPages(DecayPfn, &LockedPfns, (UINT8 *)1, (unsigned __int8)CurrentIrql);
      PageIrql[0] = 17;
    }
  }
  if( (v8 & 0x10) != 0 && !v48->u3.ReferenceCount )
  {
    LOBYTE(v74) = MiIsPfnFromSlabAllocation((INT64)v48);
    MiReplaceTransitionPage(v48, &MmGetPfnDb()[v88], (_MMPTE_COPY_LIST *)v74);
    v48->OriginalPte = ZeroPte;
    v88 = -1i64;
    MiSetOriginalPtePfnFromFreeList(&v48->OriginalPte.u.Long);
    MiReturnFreeZeroPage((INT64)v48);
  }
  if( PageIrql[0] != 17 )
    _InterlockedAnd64((volatile signed __int64 *)v47 + 3, 0x7FFFFFFFFFFFFFFFui64);
  if( v45.u.Long )
    MiReleasePageFileInfo(v44, v45, 1ui64);
  if( PageIrql[0] != 17 )
  {
    __writecr8(PageIrql[0]);
    PageIrql[0] = 17;
  }
  v15 = v85;
  if( v85 < 0 )
  {
    v14 = v88;
    dword_140C4C958 = (v85 != -1073741670) + 113;
  }
  else
  {
    if( !v102 )
    {
      SubsectionBase = v93;
      goto LABEL_103;
    }
    if( LastPfn )
    {
      LODWORD(v75) = MiGetNextDirectFixupProto(ControlAreaa, LastPfn);
      v76 = v27[1];
      v7 = v86;
      LastPfn = v75;
      v77 = v76 | 0x8000000000000000ui64;
      v102 = v77;
      if( v77 >= v108 )
      {
        v16 = Pfn1;
        goto LABEL_24;
      }
      SubsectionBase = v77;
      v78 = (__int64)(v77 - v93) >> 3;
      LODWORD(v23) = v78 + ImagePteIndex;
      v93 = v77;
      v24 = (v78 << 12) + FileOffset;
      ImagePteIndex = (unsigned int)(v78 + ImagePteIndex);
LABEL_20:
      FileOffset = v24;
      goto LABEL_21;
    }
    v14 = v88;
  }
LABEL_113:
  if( DecayPfn )
  {
    MiDecayPfnFullyInitialized(DecayPfn);
    v14 = v88;
  }
  if( (v8 & 4) != 0 )
  {
    v56 = v113;
    if( _InterlockedCompareExchange64(&v113[5]._bf_0, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v56 + 5);
    KeAbPostRelease(&v56[5]);
    KiLeaveGuardedRegionUnsafe((__int64)Thread);
    v14 = v88;
  }
  if( v14 != -1 )
  {
    v80 = &MmGetPfnDb()[v14];
    LockedPfns = v80;
    PageIrql[0] = MiLockPageInline(v80);
    MiFreeSlabPage((INT64)v80);
    _InterlockedAnd64(&v80->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(PageIrql[0]);
  }
  return v15;
}

Referenced by: