MiUnlockPageTableCharges

VOID __stdcall MiUnlockPageTableCharges(_MMPFN *Pfn1, UINT8 OldIrql, UINT64 RealPageTable){
  __int64 v3; 
  _MMPFN *v4; 
  int IsLowestPageTablePage; 
  int v6; 
  unsigned __int64 v7; 
  UINT64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v14; 
  bool v15; 
  signed __int32 v16; 
  UINT64 SpinCount; 
  v3 = 0i64;
  v4 = Pfn1;
  if( OldIrql == 2 )
  {
    IsLowestPageTablePage = MiIsLowestPageTablePage(Pfn1);
    v6 = 3;
  }
  else
  {
    if( !OldIrql )
    {
      v6 = 4;
      goto LABEL_7;
    }
    IsLowestPageTablePage = 1;
    v6 = 1;
  }
  if( !IsLowestPageTablePage )
    goto LABEL_38;
LABEL_7:
  if( (*((_QWORD *)v4 + 3) & 0x3FFFFFFFFFFFFFFFui64) < 0x10000 )
LABEL_38:
    KeBugCheckEx(
      0x1Au,
      0x41791ui64,
      (ULONG_PTR)v4,
      *((_QWORD *)v4 + 1) | 0x8000000000000000ui64,
      *((_QWORD *)v4 + 3) & 0x3FFFFFFFFFFFFFFFi64);
  v7 = 0i64;
  v8 = 0i64;
  while( 1 )
  {
    v9 = *((_QWORD *)v4 + 5);
    LODWORD(SpinCount) = 0;
    v10 = v9 & 0xFFFFFFFFFi64;
    while( _interlockedbittestandset64((volatile signed __int32 *)v4 + 6, 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( *((__int64 *)v4 + 3) < 0 );
    }
    v11 = *((_QWORD *)v4 + 3) ^ ((*((_QWORD *)v4 + 3) - 0x10000i64) ^ *((_QWORD *)v4 + 3)) & 0x3FFFFFFFFFFFFFFFi64;
    *((_QWORD *)v4 + 3) = v11;
    v12 = v11 & 0x3FFFFFFFFFFFFFFFi64;
    if( v12 >= 0x10000 )
      break;
    if( !v3 )
      v3 = *(_QWORD *)(qword_140C4E388 + 8 * ((*((_QWORD *)v4 + 5) >> 39) & 0x3FFi64));
    ++v7;
    if( !v12 && (unsigned int)MiPfnShareCountIsZero((UINT64)v4, 0i64) != 3 )
      ++v8;
    _InterlockedAnd64((volatile signed __int64 *)v4 + 3, 0x7FFFFFFFFFFFFFFFui64);
    if( !--v6 )
      goto LABEL_21;
    v4 = (_MMPFN *)((char *)MmGetPfnDb() + 48 * v10);
  }
  _InterlockedAnd64((volatile signed __int64 *)v4 + 3, 0x7FFFFFFFFFFFFFFFui64);
LABEL_21:
  if( v7 )
  {
    if( (ULONG_PTR *)v3 == &MiSystemPartition )
    {
      CurrentPrcb = KeGetCurrentPrcb();
      v14 = *((int *)CurrentPrcb + 8391);
      if( (_DWORD)v14 != -1 )
      {
        if( v7 + v14 <= 0x100 )
        {
          do
          {
            if( v7 >= 0x80000 )
              break;
            v16 = _InterlockedCompareExchange((volatile signed __int32 *)CurrentPrcb + 8391, v14 + v7, v14);
            v15 = (_DWORD)v14 == v16;
            LODWORD(v14) = v16;
            if( v15 )
              goto LABEL_35;
          }
          while( v16 != -1 && v7 + v16 <= 0x100 );
        }
        if( (int)v14 > 192
          && (_DWORD)v14 != -1
          && (_DWORD)v14 == _InterlockedCompareExchange((volatile signed __int32 *)CurrentPrcb + 8391, 192, v14) )
        {
          v7 += (int)v14 - 192;
        }
      }
    }
    if( v7 )
      _InterlockedExchangeAdd64((volatile signed __int64 *)(v3 + 7168), v7);
  }
LABEL_35:
  if( v8 )
    MiReturnCommit((_MI_PARTITION *)v3, v8);
}

Referenced by: