MiInsertLargePageChain

VOID __fastcall MiInsertLargePageChain(INT64 rcx0, INT64 a2, INT64 a3, INT64 a4, INT64 a5){
  _BOOL8 v7; 
  int v8; 
  unsigned int IsFreeZeroPfnCold; 
  unsigned __int64 v10; 
  WORK_QUEUE_TYPE v11; 
  void *v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  INT64 v15; 
  INT64 v16; 
  WORK_QUEUE_TYPE v17; 
  PVOID v18; 
  INT64 v19; 
  unsigned int v20; 
  bool v21; 
  WORK_QUEUE_TYPE v22; 
  PVOID v23; 
  INT64 *v24; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  INT64 v26; 
  INT64 a1[2]; 
  __int64 v28; 
  v26 = a3;
  v28 = 0i64;
  v7 = (*(_DWORD *)(a2 + 16) & 0x3E0i64) != 0;
  memset(&LockHandle, 0, sizeof(LockHandle));
  *(_OWORD *)a1 = 0i64;
  IsFreeZeroPfnCold = MiIsFreeZeroPfnCold(a2);
  v10 = MiLargePageSizes[v8];
  if( v8 == 2 )
  {
    MiConvertEntireLargePageToSmall((KQUEUE *)a2, 2, 1u, (LARGE_INTEGER *)v7, 0i64, 0i64);
  }
  else
  {
    v13 = MiLargePageSizes[v8 + 1];
    v14 = v10 / v13;
    v15 = v10 + (a2 - (__int64)MmGetPfnDb()) / 48 - v13;
    v16 = 48 * (v10 - v13) + a2;
    MiLockPageAtDpc(v16);
    LockHandle.LockQueue.Next = 0i64;
    a1[1] = v7 | 0x300000000i64;
    a1[0] = v15;
    LOBYTE(v28) = 2;
    LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)(rcx0 + 4328);
    KxAcquireQueuedSpinLock((PIO_WORKITEM)&LockHandle, (PIO_WORKITEM_ROUTINE)(rcx0 + 4328), v17, v18);
    while( 1 )
    {
      if( (*(_BYTE *)(v16 + 34) & 7) == 6 )
      {
        MiSetPfnPageState(v16, 5);
        MiSetFreeZeroPfnCold(v19, IsFreeZeroPfnCold);
        MiSetPfnPageState(v16, 6);
      }
      else
      {
        MiSetFreeZeroPfnCold(v16, IsFreeZeroPfnCold);
      }
      *(_BYTE *)(v16 + 39) = (unsigned __int8)v12 | *(_BYTE *)(v16 + 39) & 0xFC;
      if( (_DWORD)v14 == 1 )
      {
        if( v26 )
          break;
      }
      v21 = *(_QWORD *)(rcx0 + 4352) == 0i64;
      a1[0] = v15;
      if( v21 )
      {
        HIDWORD(a1[1]) |= 2u;
      }
      else
      {
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
        HIDWORD(a1[1]) &= ~2u;
      }
      MiInsertLargePageInNodeList((INT64)a1);
      LODWORD(v14) = v14 - 1;
      if( !(_DWORD)v14 )
        goto LABEL_21;
      v15 -= v13;
      v16 += -48i64 * v13;
      v20 = HIDWORD(a1[1]);
      v21 = (a1[1] & 0x200000000i64) == 0;
      if( (a1[1] & 0x200000000i64) != 0 )
      {
        if( _interlockedbittestandset64((volatile signed __int32 *)(v16 + 24), 0x3Fui64) )
        {
          KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
          v20 = HIDWORD(a1[1]) & 0xFFFFFFFD;
          HIDWORD(a1[1]) &= ~2u;
        }
        else
        {
          v20 = HIDWORD(a1[1]);
        }
        v21 = (v20 & 2) == 0;
      }
      if( v21 )
      {
        HIDWORD(a1[1]) = v20 | 2;
        MiLockPageAtDpc(v16);
        LockHandle.LockQueue.Next = 0i64;
        LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)(rcx0 + 4328);
        KxAcquireQueuedSpinLock((PIO_WORKITEM)&LockHandle, (PIO_WORKITEM_ROUTINE)(rcx0 + 4328), v22, v23);
      }
    }
    _InterlockedAnd64((volatile signed __int64 *)(v16 + 24), 0x7FFFFFFFFFFFFFFFui64);
  }
LABEL_21:
  if( (_DWORD)a5 )
  {
    if( (a1[1] & 0x200000000i64) == 0 )
    {
      LockHandle.LockQueue.Next = 0i64;
      LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)(rcx0 + 4328);
      KxAcquireQueuedSpinLock((PIO_WORKITEM)&LockHandle, (PIO_WORKITEM_ROUTINE)(rcx0 + 4328), v11, v12);
    }
    v24 = *(INT64 **)(rcx0 + 4288);
    *(_QWORD *)(rcx0 + 4288) = 0i64;
    --*(_DWORD *)(rcx0 + 4284);
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    if( v24 )
      MiWakeLargePageWaiters(v24);
  }
  else if( (a1[1] & 0x200000000i64) != 0 )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  }
}

Referenced by: