MiInitializeReadInProgressPfn

char __fastcall MiInitializeReadInProgressPfn(
        unsigned __int64 a1,
        _QWORD *a2,
        int a3,
        __int64 *a4,
        __int64 a5,
        char a6){
  unsigned __int64 v6; 
  _QWORD *v7; 
  unsigned __int64 v8; 
  char *v9; 
  unsigned __int64 v10; 
  unsigned __int64 Pml4eBase; 
  _MMPFN *PfnDb; 
  unsigned __int64 PxeUserLimit; 
  INT64 v14; 
  UINT64 v15; 
  unsigned __int64 v16; 
  bool v17; 
  int v18; 
  unsigned __int64 v19; 
  __int64 v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  __int64 Address; 
  char v24; 
  unsigned int v25; 
  __int64 v26; 
  unsigned __int8 CurrentIrql; 
  __int64 v28; 
  unsigned __int8 v29; 
  unsigned __int64 v30; 
  __int64 v31; 
  int v33; 
  UINT64 SpinCount; 
  INT64 v35; 
  unsigned __int64 v36; 
  unsigned __int64 v37; 
  _QWORD *v39; 
  __int64 *v40; 
  v40 = a4;
  v39 = a2;
  v6 = (unsigned __int64)a4;
  v7 = a2;
  v8 = a1;
  v9 = 0i64;
  v10 = 0xFFFFFFFFFi64;
  Pml4eBase = (unsigned __int64)&a2[a3];
  v37 = Pml4eBase;
  if( (unsigned __int64)a2 < Pml4eBase )
  {
    PfnDb = MmGetPfnDb();
    PxeUserLimit = (unsigned __int64)MmGetPxeUserLimit();
    while( 1 )
    {
      LOBYTE(Pml4eBase) = (_BYTE)PfnDb;
      v14 = (INT64)PfnDb + 48 * *v7;
      if( v14 != qword_140C4EAB0 )
        break;
LABEL_70:
      v6 += 8i64;
      v7 = v39 + 1;
      v40 = (__int64 *)v6;
      v39 = v7;
      if( (unsigned __int64)v7 >= v37 )
        return Pml4eBase;
    }
    v15 = *(_QWORD *)v6;
    v35 = v15;
    v16 = v15;
    v17 = (a6 & 0x40) != 0;
    LOBYTE(v33) = 0;
    v18 = 0;
    if( (a6 & 0x40) != 0 )
    {
      if( MiIsPrototypePteVadLookup(v15) )
      {
        v19 = v15;
      }
      else
      {
        v20 = v15;
        if( qword_140C4DC80 && (v15 & 0x10) == 0 )
          v20 = v15 & ~qword_140C4DC80;
        v35 = MI_READ_PTE_LOCK_FREE(v20 >> 16);
        v21 = MI_READ_PTE_LOCK_FREE((INT64)&v35);
        v19 = MI_READ_PTE_LOCK_FREE((INT64)MmGetPfnDb() + 48 * ((v21 >> 12) & 0xFFFFFFFFFi64) + 16);
      }
      v33 = MmMakeProtectNotWriteCopy[(v19 >> 5) & 0x1F];
      v16 = MiSwizzleInvalidPte(32i64 * (v33 & 0x1F));
    }
    else
    {
      v22 = v15;
      if( (v15 & 0x400) != 0 || (v15 & 0x800) == 0 )
        goto LABEL_19;
      if( qword_140C4DC80 && (v15 & 0x10) == 0 )
        v16 = v15 & ~qword_140C4DC80;
      v16 = *((_QWORD *)MmGetPfnDb() + 6 * ((v16 >> 12) & 0xFFFFFFFFFi64) + 2);
    }
    v22 = v16;
    v35 = v16;
LABEL_19:
    *(_QWORD *)(v14 + 16) = v16;
    if( v17 )
    {
      LODWORD(Address) = v18;
    }
    else
    {
      if( (a6 & 0x10) == 0
        || (*(_QWORD *)(v14 + 40) |= 0x8000000000000000ui64, &v35 < (INT64 *)MmGetPml4eBase())
        || (unsigned __int64)&v35 > PxeUserLimit )
      {
        PxeUserLimit = v22;
      }
      v33 = (PxeUserLimit >> 5) & 0x1F;
      Address = (PxeUserLimit >> 5) & 0x1F;
      if( v33 == 24 )
      {
        LOBYTE(v33) = 24;
        if( v8 <= 0x7FFFFFFEFFFFi64 )
        {
          Address = (__int64)MiLocateAddress(v8);
          LOBYTE(v33) = v24;
          LODWORD(Address) = (*(_DWORD *)(Address + 48) >> 7) & 0x1F;
        }
      }
    }
    if( (_DWORD)Address )
    {
      if( (_DWORD)Address == 31 )
      {
        v25 = 1;
      }
      else if( (unsigned int)Address >> 3 == 3 && (Address & 7) != 0 )
      {
        v25 = 2;
      }
      else
      {
        v25 = (unsigned int)Address >> 3 != 1;
      }
    }
    else
    {
      v25 = 3;
    }
    if( v10 == 0xFFFFFFFFFi64 )
    {
      v36 = *(_QWORD *)((char *)MmGetPteBase() + ((v6 >> 9) & 0x7FFFFFFFF8i64));
      v10 = (v36 >> 12) & 0xFFFFFFFFFi64;
      v9 = (char *)MmGetPfnDb() + 48 * v10;
    }
    v26 = v6;
    if( (a6 & 0x20) != 0 )
      v26 = v6 & 0x7FFFFFFFFFFFFFFFi64;
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)(v14 + 24), 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( *(__int64 *)(v14 + 24) < 0 );
    }
    *(_BYTE *)(v14 + 34) |= 0x20u;
    v28 = a5;
    if( a5 )
      v28 = a5 + 32;
    *(_QWORD *)v14 = v28;
    v29 = *(_BYTE *)(v14 + 34);
    if( v29 >> 6 != v25 )
    {
      MiChangePageAttribute(v14, v25, 1);
      v29 = *(_BYTE *)(v14 + 34);
    }
    *(_QWORD *)(v14 + 24) &= 0xC000000000000000ui64;
    *(_WORD *)(v14 + 32) = 1;
    if( (a6 & 8) != 0 )
      *(_BYTE *)(v14 + 35) ^= (*(_BYTE *)(v14 + 35) ^ a6) & 7;
    v30 = v10 ^ *(_QWORD *)(v14 + 40);
    *(_QWORD *)(v14 + 8) = v26;
    *(_QWORD *)(v14 + 40) ^= v30 & 0xFFFFFFFFFi64;
    *(_BYTE *)(v14 + 34) = v29 & 0xF8 | 2;
    if( a6 < 0 )
      *(_BYTE *)(v14 + 35) |= 0x20u;
    _InterlockedAnd64((volatile signed __int64 *)(v14 + 24), 0x7FFFFFFFFFFFFFFFui64);
    LOBYTE(Pml4eBase) = CurrentIrql;
    __writecr8(CurrentIrql);
    if( (v15 & 0x400) == 0 && (v15 & 0x800) != 0 )
    {
      v6 = (unsigned __int64)v40;
    }
    else
    {
      v31 = 32 * (((*v39 & 0xFFFFFFFFFi64) << 7) | v33 & 0x1F | 0x40);
      if( qword_140C4DC80 )
      {
        if( (qword_140C4DC80 & v31) != 0 )
          v31 |= 0x10ui64;
        else
          v31 |= qword_140C4DC80;
      }
      Pml4eBase = (unsigned __int64)MmGetPml4eBase();
      v6 = (unsigned __int64)v40;
      if( (unsigned __int64)v40 >= Pml4eBase )
      {
        Pml4eBase = (unsigned __int64)MmGetPxeUserLimit();
        if( (unsigned __int64)v40 <= Pml4eBase )
        {
          Pml4eBase = (unsigned __int64)KeGetCurrentThread();
          if( (*(_DWORD *)(*(_QWORD *)(Pml4eBase + 184) + 2172i64) & 0x1000) != 0 && (v31 & 1) != 0 )
          {
            LOBYTE(Pml4eBase) = 0;
            v31 |= 0x8000000000000000ui64;
          }
        }
      }
      *v40 = v31;
    }
    if( (a6 & 0x40) == 0 )
    {
      HIDWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)v9 + 6, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
        while( *((__int64 *)v9 + 3) < 0 );
      }
      Pml4eBase = *((_QWORD *)v9 + 3);
      *((_QWORD *)v9 + 3) = Pml4eBase ^ (Pml4eBase ^ (Pml4eBase + 1)) & 0x3FFFFFFFFFFFFFFFi64;
      _InterlockedAnd64((volatile signed __int64 *)v9 + 3, 0x7FFFFFFFFFFFFFFFui64);
      v6 = (unsigned __int64)v40;
    }
    v8 = a1;
    PfnDb = MmGetPfnDb();
    PxeUserLimit = (unsigned __int64)MmGetPxeUserLimit();
    goto LABEL_70;
  }
  return Pml4eBase;
}

Referenced by: