MiCombiningInProgress

INT64 __fastcall MiCombiningInProgress(INT64 *a1, INT64 a2, INT64 a3){
  INT64 v3; 
  int v5; 
  unsigned __int64 v7; 
  _ETHREAD *CurrentThread; 
  INT64 *v9; 
  __int64 v10; 
  bool v11; 
  _QWORD *v12; 
  _QWORD *v13; 
  __int64 v14; 
  _QWORD *v15; 
  _BYTE *v16; 
  INT64 v17; 
  INT64 result; 
  v3 = *a1;
  v5 = a3;
  v7 = ExAcquireSpinLockExclusive(&dword_140C4E280);
  if( v5 != 1 )
  {
    v14 = *(_QWORD *)a2;
    v15 = *(_QWORD **)(a2 + 8);
    if( *(_QWORD *)(*(_QWORD *)a2 + 8i64) == a2 && *v15 == a2 )
    {
      *v15 = v14;
      *(_QWORD *)(v14 + 8) = v15;
      RtlAvlRemoveNode((unsigned __int64 *)&qword_140C4E288, (__int64 *)(a2 + 16));
      --*((_DWORD *)a1 + 16);
      if( dword_140C4E284 == 1 )
        MiFlushEntireTbDueToAttributeChange(v17, v16);
      --dword_140C4E284;
      goto LABEL_16;
    }
LABEL_19:
    __fastfail(3u);
  }
  ++*((_DWORD *)a1 + 16);
  ++dword_140C4E284;
  if( !dword_140C4E298 )
  {
    dword_140C4E298 = 1;
    qword_140C4E290 = _InterlockedIncrement64(&PsNextSecurityDomain);
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  memset(a2, 0i64);
  v9 = (INT64 *)(v3 + 6456);
  *(_QWORD *)(a2 + 40) = CurrentThread;
  v10 = *(_QWORD *)(v3 + 6456);
  if( *(_QWORD *)(v10 + 8) != v3 + 6456 )
    goto LABEL_19;
  *(_QWORD *)a2 = v10;
  v11 = 0;
  *(_QWORD *)(a2 + 8) = v9;
  *(_QWORD *)(v10 + 8) = a2;
  *v9 = a2;
  v12 = (_QWORD *)qword_140C4E288;
  if( !qword_140C4E288 )
    goto LABEL_18;
  while( (unsigned __int64)CurrentThread < v12[3] )
  {
    v13 = (_QWORD *)*v12;
    if( !*v12 )
      goto LABEL_18;
LABEL_8:
    v12 = v13;
  }
  v13 = (_QWORD *)v12[1];
  if( v13 )
    goto LABEL_8;
  v11 = 1;
LABEL_18:
  RtlAvlInsertNodeEx((unsigned __int64 *)&qword_140C4E288, (__int64)v12, v11, (_QWORD *)(a2 + 16));
LABEL_16:
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4E280);
  result = (unsigned int)KiIrqlFlags;
  __writecr8(v7);
  return result;
}

Referenced by:

MiCombineIdenticalPages