MiReplaceRotateWithDemandZero

INT64 __fastcall MiReplaceRotateWithDemandZero(UINT64 a1, UINT64 a2, INT64 a3){
  char *v5; 
  unsigned int v6; 
  __int64 v7; 
  __int64 v8; 
  _MMPTE *PteBase; 
  unsigned __int64 v10; 
  unsigned __int64 *v11; 
  INT64 v12; 
  CHAR v13; 
  __int64 v14; 
  unsigned int v15; 
  __int64 v16; 
  __int64 v17; 
  UINT64 v18; 
  INT64 v19; 
  INT64 v20; 
  int v21; 
  __int64 *v22; 
  unsigned __int64 v23; 
  char *v24; 
  INT64 a5; 
  _MI_PFN_CACHE_ATTRIBUTE CacheAttribute[2]; 
  UINT64 IoPageFrame; 
  unsigned __int64 v29; 
  INT64 v30; 
  __int64 v31; 
  int result; 
  __int16 result_4; 
  __int64 v34; 
  __int64 v35; 
  __int64 v36; 
  __int64 v37[44]; 
  CacheAttribute[0] = a3;
  v5 = 0i64;
  IoPageFrame = 0i64;
  memset((INT64)&result, 0i64);
  v6 = 0;
  HIDWORD(a5) = 0;
  v7 = 0i64;
  v8 = *((_QWORD *)KeGetCurrentThread() + 23);
  PteBase = MmGetPteBase();
  v10 = (unsigned __int64)PteBase + ((a1 >> 9) & 0x7FFFFFFFF8i64);
  v29 = (unsigned __int64)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64);
  v11 = (unsigned __int64 *)((char *)PteBase + ((v10 >> 9) & 0x7FFFFFFFF8i64));
  result_4 = 0;
  v12 = v8 + 1664;
  v35 = 0i64;
  LODWORD(v34) = 20;
  result = 1;
  v36 = 0i64;
  v30 = v12;
  LOBYTE(a5) = MiLockWorkingSetShared(v12);
  if( v10 <= v29 )
  {
    v14 = (_QWORD)MmGetPteBase() << 25;
    v31 = v14;
    while( 1 )
    {
      if( !v5 )
        goto LABEL_29;
      if( (v10 & 0xFFF) == 0 )
        break;
LABEL_5:
      if( !v6 )
      {
        MiIsProbeActive((_MMPTE *)v10, 1ui64, 3i64, v13);
        v6 = v15;
      }
      if( (unsigned int)MiUnmapFrameBuffer((_MMPTE *)v10, CacheAttribute[0], v6, &IoPageFrame) )
        v6 = 1;
      if( IoPageFrame != -1i64 )
      {
        if( (_DWORD)v7
          && (v16 = 2i64 * (unsigned int)(v7 - 1), v17 = v37[2 * (unsigned int)(v7 - 1) + 1], v17 == IoPageFrame) )
        {
          v18 = v17 + 1;
        }
        else
        {
          v18 = IoPageFrame + 1;
          v16 = 2i64 * (unsigned int)v7;
          v7 = (unsigned int)(v7 + 1);
          v37[v16] = IoPageFrame;
        }
        v37[v16 + 1] = v18;
      }
      MiInsertTbFlushEntry((INT64)&result, (__int64)((v10 << 25) - v14) >> 16, 1i64, 0i64);
      ++HIDWORD(a5);
      v10 += 8i64;
      if( (v10 & 0xFFF) != 0 && v10 <= v29 && (_DWORD)v7 != 22 )
      {
        if( (v10 & 0x78) != 0 )
          continue;
        if( !MiWorkingSetIsContended(v12) )
        {
          MiPageTableLockIsContended(v12, (UINT64)v5, v19, v20, a5, *(INT64 *)CacheAttribute, IoPageFrame);
          if( !v21 && !KeShouldYieldProcessor() )
            continue;
        }
      }
      MiFlushTbList((__int64)&result);
      if( (_DWORD)v7 )
      {
        v22 = v37;
        do
        {
          MiDereferenceIoPages(1i64, *v22, v22[1] - *v22);
          v22 += 2;
          --v7;
        }
        while( v7 );
        v12 = v30;
        v14 = v31;
      }
      v23 = *v11;
      MiPteInShadowRange((UINT64)v11);
      v24 = (char *)MmGetPfnDb() + 48 * ((v23 >> 12) & 0xFFFFFFFFFi64);
      CacheAttribute[1] = MiNonCached;
      while( _interlockedbittestandset64((volatile signed __int32 *)v24 + 6, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx((UINT64 *)&CacheAttribute[1]);
        while( *((__int64 *)v24 + 3) < 0 );
      }
      *((_QWORD *)v24 + 3) ^= (*((_QWORD *)v24 + 3) ^ (*((_QWORD *)v24 + 3) - HIDWORD(a5))) & 0x3FFFFFFFFFFFFFFFi64;
      _InterlockedAnd64((volatile signed __int64 *)v24 + 3, 0x7FFFFFFFFFFFFFFFui64);
      MiUnlockPageTableInternal(v12, (UINT64)v5);
      MiUnlockWorkingSetShared(v12, a5);
      if( v10 > v29 )
        return v6;
      v7 = 0i64;
      v11 = (unsigned __int64 *)((char *)MmGetPteBase() + ((v10 >> 9) & 0x7FFFFFFFF8i64));
      HIDWORD(a5) = 0;
      v5 = 0i64;
      MiLockWorkingSetShared(v12);
    }
    MiUnlockPageTableInternal(v12, (UINT64)v5);
LABEL_29:
    v5 = (char *)MmGetPteBase() + ((v10 >> 9) & 0x7FFFFFFFF8i64);
    MiLockPageTableInternal(v12, (UINT64)v5, 0i64);
    goto LABEL_5;
  }
  return v6;
}

Referenced by: