MiLockVadRange

__int64 __fastcall MiLockVadRange(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, int a4){
  _ETHREAD *CurrentThread; 
  int v5; 
  unsigned __int64 v6; 
  int v8; 
  RTL_BALANCED_NODE *Address; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  __int64 i; 
  _QWORD *v17; 
  __int64 v18; 
  __int64 v19; 
  RTL_BALANCED_NODE *v20; 
  __int64 *v21; 
  __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  _QWORD *v25; 
  unsigned __int64 j; 
  __int64 v27; 
  __int128 v28[4]; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v28[0] = 0i64;
  v5 = a4;
  v6 = a2;
  v8 = 1;
LABEL_2:
  if( v5 )
    LOCK_ADDRESS_SPACE((__int64)CurrentThread, a1);
  else
    LOCK_ADDRESS_SPACE_SHARED(CurrentThread, (_EPROCESS *)a1);
  if( !v8 || (*(_DWORD *)(a1 + 1124) & 0x20) != 0 )
    return 0i64;
  if( v6 == -1i64 )
  {
    v20 = *(RTL_BALANCED_NODE **)(a1 + 2008);
    Address = 0i64;
    while( v20 )
    {
      Address = v20;
      v20 = v20->Children[0];
    }
  }
  else
  {
    Address = MiLocateAddress(v6);
  }
  v10 = 0i64;
  v11 = (__int64)Address;
  v12 = 0i64;
  while( v11 )
  {
    v13 = *(_QWORD *)(v11 + 8);
    v14 = v11;
    if( v13 )
    {
      v17 = *(_QWORD **)v13;
      if( *(_QWORD *)v13 )
      {
        do
        {
          v13 = (unsigned __int64)v17;
          v17 = (_QWORD *)*v17;
        }
        while( v17 );
      }
    }
    else
    {
      for( i = *(_QWORD *)(v11 + 16); ; i = *(_QWORD *)(v13 + 16) )
      {
        v13 = i & 0xFFFFFFFFFFFFFFFCui64;
        if( !v13 || *(_QWORD *)v13 == v14 )
          break;
        v14 = v13;
      }
    }
    if( a3 != -1i64 )
    {
      v18 = *(unsigned int *)(v11 + 28);
      if( a3 <= (v18 | ((unsigned __int64)*(unsigned __int8 *)(v11 + 33) << 32)) << 12 )
      {
        v13 = 0i64;
        goto LABEL_23;
      }
      if( v13 )
      {
        if( (v18 | ((unsigned __int64)*(unsigned __int8 *)(v11 + 33) << 32)) + 1 == (*(unsigned int *)(v13 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v13 + 32) << 32)) )
          goto LABEL_23;
        v13 = 0i64;
      }
      v8 = 0;
    }
LABEL_23:
    if( (unsigned int)MiVadIsCfgBitmap((_MMVAD *)v11) == 1 )
    {
      *((_QWORD *)v28 + v12) = v11;
      v12 = (unsigned int)(v12 + 1);
    }
    else
    {
      if( v10 )
        ExAcquirePushLockExclusiveEx(v11 + 40, 0i64);
      else
        MiLockVad((__int64)CurrentThread, v11);
      if( (unsigned int)MiVadDeleted(v11) == 1 || !v8 )
      {
        MiReferenceVad(v19);
        if( Address != (RTL_BALANCED_NODE *)v11 )
        {
          do
          {
            v23 = (unsigned __int64)Address->Children[1];
            v24 = (unsigned __int64)Address;
            if( v23 )
            {
              v25 = *(_QWORD **)v23;
              if( *(_QWORD *)v23 )
              {
                do
                {
                  v23 = (unsigned __int64)v25;
                  v25 = (_QWORD *)*v25;
                }
                while( v25 );
              }
            }
            else
            {
              for( j = Address->ParentValue; ; j = *(_QWORD *)(v23 + 16) )
              {
                v23 = j & 0xFFFFFFFFFFFFFFFCui64;
                if( !v23 || *(_QWORD *)v23 == v24 )
                  break;
                v24 = v23;
              }
            }
            if( !(unsigned int)MiVadIsCfgBitmap((_MMVAD *)Address) )
            {
              if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&Address[1].16, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
                ExfTryToWakePushLock((volatile INT64 *)&Address[1].16);
              KeAbPostRelease(&Address[1].16);
            }
            Address = (RTL_BALANCED_NODE *)v23;
          }
          while( v23 != v11 );
        }
        if( a4 )
          UNLOCK_ADDRESS_SPACE_UNORDERED((__int64)CurrentThread, a1);
        else
          UNLOCK_ADDRESS_SPACE_SHARED_UNORDERED((__int64)CurrentThread, a1);
        if( (unsigned int)MiVadDeleted(v11) == 1 )
          MiWaitForVadDeletion(v27);
        MiUnlockAndDereferenceVad((PVOID)v11);
        v5 = a4;
        v6 = a2;
        goto LABEL_2;
      }
      ++v10;
    }
    v11 = v13;
  }
  if( v8 == 1 && (_DWORD)v12 )
  {
    v21 = (__int64 *)v28;
    v22 = (unsigned int)v12;
    do
    {
      if( v10 )
        ExAcquirePushLockExclusiveEx(*v21 + 40, 0i64);
      else
        MiLockVad((__int64)CurrentThread, *v21);
      ++v10;
      ++v21;
      --v22;
    }
    while( v22 );
  }
  return v10;
}

Referenced by: