MiAgeWorkingSetTail

INT64 __fastcall MiAgeWorkingSetTail(INT64 a1){
  __int64 v1; 
  int i; 
  int *v4; 
  UINT64 v5; 
  _DWORD *v6; 
  char v8; 
  unsigned __int64 v9; 
  unsigned int v10; 
  __int64 v11; 
  unsigned int v12; 
  v1 = *(_QWORD *)(a1 + 168);
  for( i = 0; ; i = 1 )
  {
    v4 = *(int **)(v1 + 56);
    if( !v4 )
      goto LABEL_4;
    v5 = (unsigned int)v4[3];
    if( !(_DWORD)v5 )
      goto LABEL_4;
    v8 = *((_BYTE *)v4 + 4);
    v9 = qword_140C4DCD0;
    if( (v8 & 2) == 0 )
    {
      v10 = *v4;
      if( *v4 != 1 )
        goto LABEL_24;
      v11 = *((_QWORD *)KeGetCurrentThread() + 23);
      if( *(_QWORD *)(v11 + 2288) || *(_QWORD *)(v11 + 992) )
        v9 = -1i64;
    }
    v10 = *v4;
    if( *v4 != 1 )
    {
LABEL_24:
      v12 = 1;
      if( (v8 & 8) != 0 )
        v12 = 2;
      goto LABEL_16;
    }
    v12 = 0;
LABEL_16:
    if( *((_BYTE *)v4 + 5) || *((_QWORD *)v4 + 2) > v9 )
    {
      if( (v8 & 1) != 0 )
        KeFlushCurrentTbOnly(v10);
      else
        KeFlushTb(v10, v12);
      *((_BYTE *)v4 + 5) = 0;
    }
    else if( (v8 & 1) != 0 )
    {
      KeFlushMultipleRangeCurrentTb(v5, (UINT64 *)v4 + 3, v10);
    }
    else
    {
      KeFlushMultipleRangeTb(v5, (UINT64 *)v4 + 3, v10, v12);
    }
    *((_BYTE *)v4 + 4) &= ~8u;
    v4[3] = 0;
    *((_QWORD *)v4 + 2) = 0i64;
LABEL_4:
    if( *(_DWORD *)(v1 + 76) )
      MiFreeWsleList(*(_QWORD *)(a1 + 24), v1 + 64, 0);
    v6 = *(_DWORD **)(v1 + 248);
    if( !v6 || !*v6 || !(unsigned int)MiQueryEPTAccessedState(a1, v6) )
      break;
    MiProcessVmAccessedInfo(
      a1,
      *(_DWORD **)(v1 + 248),
      (__int64(__fastcall *)(__int64, _QWORD *, char *, unsigned __int64, __int64))MiAgeWorkingSetEPTCallback,
      v1);
  }
  if( (*(_BYTE *)(a1 + 2) & 2) != 0 || i )
    *(_BYTE *)(v1 + 6) = 1;
  return 0i64;
}

Referenced by: