MiUnmapPatchTable

INT64 __fastcall MiUnmapPatchTable(UINT64 a1){
  UINT64 v2; 
  __int64 v3; 
  __int64 SessionVm; 
  INT64 v5; 
  char *v6; 
  UINT8 v7; 
  UINT64 v8; 
  char *v9; 
  UINT8 SpinCount; 
  int SpinCount_4; 
  UINT64 v13; 
  UINT64 v14; 
  int result; 
  __int16 result_4; 
  __int64 v17; 
  __int64 v18; 
  __int64 v19; 
  memset((INT64)&result, 0i64);
  v2 = a1 + 8 * (((unsigned int)dword_140C4C9F0 >> 12) + ((dword_140C4C9F0 & 0xFFF) != 0) - 1i64);
  v14 = v2;
  v3 = (__int64)((a1 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  SessionVm = MiGetSessionVm();
  result = 2;
  v5 = SessionVm;
  result_4 = 0;
  v18 = 0i64;
  v6 = 0i64;
  LODWORD(v17) = 20;
  v19 = 0i64;
  SpinCount = MiLockWorkingSetShared(SessionVm);
  v7 = SpinCount;
  if( a1 > v2 )
    return MiUnlockWorkingSetShared(v5, v7);
  do
  {
    if( v6 )
    {
      if( (a1 & 0xFFF) != 0 )
        goto LABEL_6;
      MiFlushTbList((__int64)&result);
      MiUnlockPageTableInternal(v5, (UINT64)v6);
    }
    v6 = (char *)MmGetPteBase() + ((a1 >> 9) & 0x7FFFFFFFF8i64);
    MiLockPageTableInternal(v5, (UINT64)v6, 0i64);
LABEL_6:
    v13 = MI_READ_PTE_LOCK_FREE(a1);
    v8 = v13;
    if( (v13 & 1) != 0 )
    {
      MiPteInShadowRange((UINT64)&v13);
      v9 = (char *)MmGetPfnDb() + 48 * ((v8 >> 12) & 0xFFFFFFFFFi64);
      SpinCount_4 = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)v9 + 6, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx((UINT64 *)&SpinCount_4);
        while( *((__int64 *)v9 + 3) < 0 );
      }
      MiDecrementShareCount((UINT64)v9);
      _InterlockedAnd64((volatile signed __int64 *)v9 + 3, 0x7FFFFFFFFFFFFFFFui64);
      MiInsertTbFlushEntry((INT64)&result, v3, 1i64, 0i64);
    }
    *(_QWORD *)a1 = ZeroPte;
    a1 += 8i64;
    v3 += 4096i64;
  }
  while( a1 <= v14 );
  v7 = SpinCount;
  if( v6 )
  {
    MiFlushTbList((__int64)&result);
    MiUnlockPageTableInternal(v5, (UINT64)v6);
  }
  return MiUnlockWorkingSetShared(v5, v7);
}

Referenced by: