MiFlushSectionInternal

NTSTATUS __stdcall MiFlushSectionInternal(
        _MMPTE *StartingPte,
        _MMPTE *FinalPte,
        _SUBSECTION *FirstSubsection,
        _SUBSECTION *LastSubsection,
        _MI_OVERLAPPED_FLUSH_ENTRY *OverlappedFlushEntry,
        UINT64 Flags,
        _IO_STATUS_BLOCK *IoStatus){
  int v9; 
  int v10; 
  _CONTROL_AREA *v11; 
  _MDL *v12; 
  bool v13; 
  __int64 v14; 
  _SUBSECTION *v15; 
  unsigned __int64 SubsectionBase; 
  unsigned __int64 v17; 
  __int64 bf_0; 
  __int64 v19; 
  _SUBSECTION *v20; 
  _MMPTE *v21; 
  _MMPFN *v22; 
  UINT8 v23; 
  int v24; 
  unsigned __int64 v25; 
  unsigned __int64 v26; 
  __int64 v27; 
  _MMPFN *v28; 
  unsigned __int64 v29; 
  char v30; 
  unsigned int *p_ByteCount; 
  unsigned int v32; 
  int v33; 
  __int64 v34; 
  int v35; 
  _MI_PARTITION *v36; 
  int v37; 
  int v38; 
  unsigned int v39; 
  struct _KPRCB *CurrentPrcb; 
  signed __int32 CachedResidentAvailable; 
  signed __int32 v42; 
  _MI_RESAVAIL_CHARGE v43; 
  int v44; 
  char v45; 
  unsigned int ByteOffset; 
  unsigned int v47; 
  unsigned int v48; 
  int v49; 
  __int64 v50; 
  __int64 v51; 
  UINT64 v52; 
  UINT64 v53; 
  PVOID v54; 
  _MI_OVERLAPPED_FLUSH_ENTRY *v55; 
  _CONTROL_AREA *v56; 
  _IO_STATUS_BLOCK *v57; 
  NTSTATUS result; 
  _SUBSECTION *v59; 
  UINT64 v60; 
  _CONTROL_AREA *v61; 
  unsigned __int64 v62; 
  int v63; 
  _MDL *v64; 
  UINT64 v65; 
  _IO_STATUS_BLOCK *v66; 
  INT64 Status; 
  INT64 *v68; 
  int v69; 
  __int16 v70; 
  int v71; 
  int v72; 
  __int64 v73; 
  _MDL *v74; 
  _MI_FLUSH_ENTRY *v75; 
  _SUBSECTION *NextSubsection; 
  char *Pool; 
  _MI_OVERLAPPED_FLUSH_ENTRY *v78; 
  char *v79; 
  char *v80; 
  _QWORD *v81; 
  _MI_PARTITION *v82; 
  unsigned __int64 v83; 
  struct _KPRCB *v84; 
  __int64 v85; 
  signed __int32 v86; 
  _MI_FLUSH_ENTRY *v87; 
  _LARGE_INTEGER *v88; 
  __int64 v89; 
  __int16 v90; 
  int v91; 
  int v92; 
  UINT64 IrpSpFlags; 
  UINT64 *IoPriority; 
  char PageIrql[4]; 
  int v96; 
  ULONG_PTR ProtoPagePfn[2]; 
  unsigned __int64 v98; 
  __int64 v99; 
  int v100; 
  _IO_STATUS_BLOCK *v101; 
  int v102; 
  _MDL *Mdl; 
  UINT64 v104; 
  unsigned __int64 v105; 
  UINT8 WsIrql[4]; 
  _IO_PRIORITY_HINT IoPriorityThread; 
  _MI_OVERLAPPED_FLUSH_ENTRY *v108; 
  unsigned int v109; 
  _MI_FLUSH_ENTRY *FlushEntry; 
  _SUBSECTION *Subsection; 
  INT64 *SpinLock; 
  PVOID P; 
  _FILE_OBJECT *FileObject; 
  _CONTROL_AREA *ControlArea; 
  _SUBSECTION *LastSubsectiona; 
  UINT64 SpinCount; 
  VOID *OpaqueContext; 
  _MI_PARTITION *v119; 
  unsigned __int64 v120; 
  _ETHREAD *Thread; 
  _MMPTE *v122; 
  VOID *ProtoPte; 
  __int64 v124; 
  _SUBSECTION *FirstSubsectiona; 
  char v126[192]; 
  _MMPFN v127[3]; 

  FirstSubsectiona = FirstSubsection;
  ProtoPte = StartingPte;
  v108 = OverlappedFlushEntry;
  v101 = IoStatus;
  *(_DWORD *)WsIrql = 0;
  PageIrql[0] = 0;
  LastSubsectiona = LastSubsection;
  memset(v126, 0i64, 0xB8u);
  v9 = Flags;
  v10 = 0;
  if( (Flags & 2) == 0 )
    v10 = 2;
  if( OverlappedFlushEntry )
  {
    v9 = Flags | 4;
    LODWORD(Flags) = Flags | 4;
  }
  v11 = FirstSubsection->ControlArea;
  P = 0i64;
  FlushEntry = 0i64;
  v12 = (_MDL *)v126;
  Mdl = (_MDL *)v126;
  v13 = (v11->u.LongFlags & 0x40000000) == 0;
  ControlArea = v11;
  if( !v13 )
  {
    v9 &= ~4u;
    LODWORD(Flags) = v9;
  }
  if( (v9 & 4) != 0 )
  {
    Pool = (char *)MiAllocatePool(64i64, 0xA00ui64, 0x61466D4Dui64);
    v78 = v108;
    v79 = Pool;
    P = Pool;
    if( v108 )
    {
      *((_QWORD *)v108 + 5) = Pool;
      if( !Pool )
        return -1073741670;
    }
    else if( !Pool )
    {
      goto LABEL_8;
    }
    *((_WORD *)Pool + 24) = 0;
    v80 = Pool + 48;
    Pool[50] = 6;
    v12 = (_MDL *)(Pool + 80);
    FlushEntry = (_MI_FLUSH_ENTRY *)Pool;
    *((_DWORD *)Pool + 13) = 0;
    v81 = Pool + 56;
    v81[1] = v81;
    *v81 = v81;
    *(_DWORD *)v79 = 0;
    *((_QWORD *)v79 + 2) = 0i64;
    *((_QWORD *)v79 + 5) = v78;
    *((_QWORD *)v79 + 4) = v11;
    *((_QWORD *)v79 + 9) = v12;
    *((_QWORD *)v79 + 264) = v80;
    *((_WORD *)v79 + 156) = 0;
    v79[314] = 6;
    *((_DWORD *)v79 + 79) = 0;
    *((_QWORD *)v79 + 41) = v79 + 320;
    *((_QWORD *)v79 + 40) = v79 + 320;
    *((_QWORD *)v79 + 42) = v79 + 344;
    *((_DWORD *)v79 + 66) = 0;
    *((_QWORD *)v79 + 35) = 0i64;
    *((_QWORD *)v79 + 38) = v78;
    *((_QWORD *)v79 + 37) = v11;
    *((_QWORD *)v79 + 265) = v79 + 312;
    *((_WORD *)v79 + 288) = 0;
    v79[578] = 6;
    *((_DWORD *)v79 + 145) = 0;
    *((_QWORD *)v79 + 74) = v79 + 584;
    *((_QWORD *)v79 + 73) = v79 + 584;
    *((_QWORD *)v79 + 75) = v79 + 608;
    *((_DWORD *)v79 + 132) = 0;
    *((_QWORD *)v79 + 68) = 0i64;
    *((_QWORD *)v79 + 71) = v78;
    *((_QWORD *)v79 + 70) = v11;
    *((_QWORD *)v79 + 266) = v79 + 576;
    *((_WORD *)v79 + 420) = 0;
    v79[842] = 6;
    *((_DWORD *)v79 + 211) = 0;
    *((_QWORD *)v79 + 107) = v79 + 848;
    *((_QWORD *)v79 + 106) = v79 + 848;
    *((_QWORD *)v79 + 108) = v79 + 872;
    *((_DWORD *)v79 + 198) = 0;
    *((_QWORD *)v79 + 101) = 0i64;
    *((_QWORD *)v79 + 104) = v78;
    *((_QWORD *)v79 + 103) = v11;
    *((_QWORD *)v79 + 267) = v79 + 840;
    *((_WORD *)v79 + 552) = 0;
    v79[1106] = 6;
    *((_DWORD *)v79 + 277) = 0;
    *((_QWORD *)v79 + 140) = v79 + 1112;
    *((_QWORD *)v79 + 139) = v79 + 1112;
    *((_QWORD *)v79 + 141) = v79 + 1136;
    *((_DWORD *)v79 + 264) = 0;
    *((_QWORD *)v79 + 134) = 0i64;
    *((_QWORD *)v79 + 137) = v78;
    *((_QWORD *)v79 + 136) = v11;
    *((_QWORD *)v79 + 268) = v79 + 1104;
    *((_WORD *)v79 + 684) = 0;
    v79[1370] = 6;
    *((_DWORD *)v79 + 343) = 0;
    *((_QWORD *)v79 + 173) = v79 + 1376;
    *((_QWORD *)v79 + 172) = v79 + 1376;
    *((_DWORD *)v79 + 330) = 0;
    Mdl = v12;
    *((_QWORD *)v79 + 167) = 0i64;
    *((_QWORD *)v79 + 174) = v79 + 1400;
    *((_QWORD *)v79 + 170) = v78;
    *((_QWORD *)v79 + 169) = v11;
    *((_QWORD *)v79 + 269) = v79 + 1368;
    *((_WORD *)v79 + 816) = 0;
    v79[1634] = 6;
    *((_DWORD *)v79 + 409) = 0;
    *((_QWORD *)v79 + 206) = v79 + 1640;
    *((_QWORD *)v79 + 205) = v79 + 1640;
    *((_QWORD *)v79 + 207) = v79 + 1664;
    *((_DWORD *)v79 + 396) = 0;
    *((_QWORD *)v79 + 200) = 0i64;
    *((_QWORD *)v79 + 203) = v78;
    *((_QWORD *)v79 + 202) = v11;
    *((_QWORD *)v79 + 270) = v79 + 1632;
    *((_WORD *)v79 + 948) = 0;
    v79[1898] = 6;
    *((_DWORD *)v79 + 475) = 0;
    *((_QWORD *)v79 + 239) = v79 + 1904;
    *((_QWORD *)v79 + 238) = v79 + 1904;
    *((_QWORD *)v79 + 240) = v79 + 1928;
    *((_DWORD *)v79 + 462) = 0;
    *((_QWORD *)v79 + 233) = 0i64;
    *((_QWORD *)v79 + 236) = v78;
    *((_QWORD *)v79 + 235) = v11;
    *((_QWORD *)v79 + 271) = v79 + 1896;
  }
LABEL_8:
  v122 = FinalPte + 1;
  FileObject = MiReferenceControlAreaFile(v11);
  Thread = (_ETHREAD *)KeGetCurrentThread();
  IoPriorityThread = PsGetIoPriorityThread(Thread);
  if( IoPriorityThread < IoPriorityNormal
    && (*(_DWORD *)(v14 + 116) & 0x400) == 0
    && *(_BYTE *)(v14 + 562) != 1
    && KeGetCurrentThread()[1].TrapFrame != (_KTRAP_FRAME *)2 )
  {
    IoPriorityThread = IoPriorityNormal;
  }
  if( v9 < 0 )
    v10 |= 0x10u;
  Subsection = FirstSubsection;
  IoStatus->Status = 0;
  v15 = FirstSubsection;
  SubsectionBase = (unsigned __int64)ProtoPte;
  IoStatus->Information = 0i64;
  v12->Next = 0i64;
  v12->MdlFlags = 0;
  v12->StartVa = 0i64;
  *(_QWORD *)&v12->ByteCount = 0i64;
  --*(_WORD *)(v14 + 484);
  v96 = 16;
  v102 = 0;
  v100 = 1;
  v99 = 0i64;
  v98 = SubsectionBase;
  SpinLock = (INT64 *)&v11->ControlAreaLock;
  v17 = (unsigned __int8)ExAcquireSpinLockExclusive((INT64 *)&v11->ControlAreaLock);
  if( !v11->NumberOfPfnReferences )
  {
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&v11->ControlAreaLock);
    __writecr8(v17);
    if( P )
    {
      ExFreePoolWithTag(P, 0);
      if( v108 )
        *((_QWORD *)v108 + 5) = 0i64;
    }
    MiDereferenceControlAreaFile(v11, FileObject);
    KeLeaveCriticalRegionThread(&Thread->Tcb);
    result = 0;
    IoStatus->Status = 0;
    IoStatus->Information = 0i64;
    return result;
  }
  bf_0 = v11->u3._bf_0;
  OpaqueContext = (VOID *)(8 * bf_0);
  if( 8 * bf_0 && _InterlockedIncrement64((volatile signed __int64 *)(8 * bf_0 + 32)) <= 1 )
    __fastfail(0xEu);
  v104 = 0i64;
  v19 = 0i64;
  v20 = LastSubsectiona;
  while( 1 )
  {
LABEL_14:
    if( v15 == v20 )
    {
      v21 = v122;
    }
    else
    {
      v21 = &v15->SubsectionBase[v15->PtesInSubsection - (v15->_bf_34 & 0x3FFFFFFF)];
      v20 = LastSubsectiona;
    }
    v105 = (unsigned __int64)v21;
    if( !SubsectionBase )
    {
      SubsectionBase = (unsigned __int64)v15->SubsectionBase;
      v98 = SubsectionBase;
    }
    if( v15[1].u1.e1._bf_0 && v15->SubsectionBase )
      break;
    v19 += (__int64)((__int64)v21 - SubsectionBase) >> 3 << 12;
    NextSubsection = v15->NextSubsection;
    v99 = v19;
    if( !NextSubsection )
    {
      if( v21 == &v15->SubsectionBase[v15->PtesInSubsection - (v15->_bf_34 & 0x3FFFFFFF)] )
      {
        MiEndingOffset(v15);
        v50 = v99;
        v53 = v104;
        v91 = v90 & 0xFFF;
        if( v91 )
          v50 = v99 - (unsigned int)(4096 - v91);
        goto LABEL_92;
      }
LABEL_210:
      v53 = v104;
      v50 = v19;
      goto LABEL_92;
    }
    if( v20 == v15 )
      goto LABEL_210;
    SubsectionBase = (unsigned __int64)NextSubsection->SubsectionBase;
    v15 = NextSubsection;
    v98 = SubsectionBase;
    Subsection = NextSubsection;
  }
  MiIncrementSubsectionViewCount((_MSUBSECTION *)v15, 0i64);
  if( (v15->u.SubsectionFlags._bf_2 & 8) != 0 )
    MiRemoveUnusedSubsection((_MSUBSECTION *)v15);
  ExReleaseSpinLockExclusiveFromDpcLevel(SpinLock);
  __writecr8((unsigned __int8)v17);
  v120 = SubsectionBase;
  LODWORD(v22) = 0;
  v23 = 17;
  *(_QWORD *)ProtoPagePfn = 0i64;
  PageIrql[0] = 17;
  if( SubsectionBase >= (unsigned __int64)v21 )
    goto LABEL_87;
  while( 1 )
  {
    v24 = v10;
    if( (SubsectionBase & 0xFFF) != 0 )
    {
      if( v23 != 17 )
        goto LABEL_25;
    }
    else if( v23 != 17 )
    {
      MiUnlockProtoPoolPage((ULONG_PTR)v22, v23);
    }
    v22 = MiCheckProtoPtePageState((VOID *)SubsectionBase, (UINT8 *)PageIrql);
    *(_QWORD *)ProtoPagePfn = v22;
    if( v22 )
      break;
    p_ByteCount = &v12->ByteCount;
    SubsectionBase = (SubsectionBase & 0xFFFFFFFFFFFFF000ui64) + 4096;
    v13 = v12->ByteCount == 0;
    v98 = SubsectionBase;
    if( !v13 )
    {
LABEL_103:
      v23 = PageIrql[0];
      if( PageIrql[0] != 17 )
      {
        MiUnlockProtoPoolPage((ULONG_PTR)v22, PageIrql[0]);
        v23 = 17;
        PageIrql[0] = 17;
      }
      goto LABEL_105;
    }
    v23 = PageIrql[0];
LABEL_71:
    if( SubsectionBase >= v105 )
      goto LABEL_84;
  }
  while( 1 )
  {
    while( 1 )
    {
LABEL_25:
      v25 = *(_QWORD *)SubsectionBase;
      v26 = *(_QWORD *)SubsectionBase;
      if( (*(_QWORD *)SubsectionBase & 1) != 0 )
        goto LABEL_33;
      if( (*(_QWORD *)SubsectionBase & 0xC00i64) != 2048 )
        goto LABEL_64;
      if( !v25 || !*(&stru_140C4DB30 + 42) || (v25 & *(&stru_140C4DB30 + 42)) != 0 )
      {
        v26 = *(_QWORD *)SubsectionBase;
        if( *(&stru_140C4DB30 + 42) && (v25 & 0x10) == 0 )
          v26 = v25 & ~*(&stru_140C4DB30 + 42);
LABEL_33:
        v27 = (v26 >> 12) & 0xFFFFFFFFFi64;
        v124 = v27 * 48;
        if( (MmGetPfnDb()[v27].u4._bf_0 & 0x4000000000000i64) != 0 )
          break;
      }
    }
    v28 = &MmGetPfnDb()[v27];
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)&v28->u2, 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( v28->u2._bf_0 < 0 );
    }
    if( *(_QWORD *)SubsectionBase == v25 )
      break;
    _InterlockedAnd64(&v28->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  }
  if( !v28 )
  {
LABEL_64:
    p_ByteCount = &v12->ByteCount;
    goto LABEL_65;
  }
  v29 = *(_QWORD *)SubsectionBase;
  v30 = *((_BYTE *)&v28->u3 + 2);
  p_ByteCount = &v12->ByteCount;
  if( (v30 & 8) != 0 )
  {
    if( !*p_ByteCount )
    {
      if( (v10 & 2) != 0 )
      {
        MiWaitForPageWriteCompletion(v28, ControlArea, ProtoPagePfn[0], PageIrql[0]);
        v23 = 17;
        PageIrql[0] = 17;
        goto LABEL_70;
      }
      _InterlockedAnd64(&v28->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
      v23 = PageIrql[0];
      v10 |= 8u;
LABEL_204:
      SubsectionBase = v105;
      goto LABEL_84;
    }
    goto LABEL_140;
  }
  if( (v30 & 0x10) == 0 )
  {
    _InterlockedAnd64(&v28->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
LABEL_65:
    v47 = *p_ByteCount;
    v10 |= 4u;
    if( !*p_ByteCount )
      v10 = v24;
LABEL_67:
    SubsectionBase += 8i64;
    v98 = SubsectionBase;
    if( (v10 & 4) == 0 && (SubsectionBase != v105 || !v47) )
    {
      v23 = PageIrql[0];
      goto LABEL_70;
    }
    goto LABEL_102;
  }
  v32 = *p_ByteCount;
  if( (v30 & 0x20) != 0 )
  {
    memset(v127, 0i64, 0x88u);
    if( !v32 )
    {
      *(_DWORD *)WsIrql = 1;
      MiInitializePageFaultPacket(0i64, 0i64, 0, 0i64, (INT64)v127);
      MiObtainProtoReference(*(_MMPFN **)ProtoPagePfn, 1ui64);
      MiWaitForCollidedFaultComplete(
        v127,
        v28,
        *(VOID **)ProtoPagePfn,
        (_MMSUPPORT_INSTANCE *)(unsigned __int8)PageIrql[0],
        (UINT8)WsIrql,
        IrpSpFlags,
        IoPriority);
      v23 = 17;
      PageIrql[0] = 17;
      goto LABEL_70;
    }
LABEL_140:
    _InterlockedAnd64(&v28->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
LABEL_102:
    LODWORD(v22) = ProtoPagePfn[0];
    goto LABEL_103;
  }
  v33 = 0;
  if( !v32 )
  {
    v33 = 2;
    ExAcquireSpinLockExclusiveAtDpcLevel(SpinLock);
    v68 = SpinLock;
    ++ControlArea->ModifiedWriteCount;
    ExReleaseSpinLockExclusiveFromDpcLevel(v68);
    v69 = v96;
    v12->Next = 0i64;
    v12->MdlFlags = 0;
    v12->StartVa = 0i64;
    *p_ByteCount = 0;
    v12->ByteOffset = v69;
  }
  v34 = v29 & 1;
  v35 = 0;
  v36 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)v28->u4._bf_0 >> 39) & 0x3FF));
  v37 = *((_DWORD *)&v28->3 + 4);
  v119 = v36;
  if( (v37 & 0x400) != 0 )
    v35 = 1;
  v38 = v33 & 2;
  v39 = 4;
  if( !v34 )
    v38 = v33;
  if( !v38 )
    v39 = 8;
  v109 = v39;
  if( v36 == &Irp )
  {
    CurrentPrcb = KeGetCurrentPrcb();
    CachedResidentAvailable = CurrentPrcb->CachedResidentAvailable;
    if( CachedResidentAvailable )
    {
      while( CachedResidentAvailable != -1 )
      {
        v42 = CachedResidentAvailable;
        CachedResidentAvailable = _InterlockedCompareExchange(
                                    (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                                    CachedResidentAvailable - 1,
                                    CachedResidentAvailable);
        if( v42 == CachedResidentAvailable )
        {
          v43 = MiChargedLocal;
          goto LABEL_53;
        }
        if( !CachedResidentAvailable )
          break;
      }
    }
  }
  v43 = MiChargePartitionResidentAvailable(v36, 1ui64, (unsigned int)-(v38 != 0));
  if( v43 == MiChargeFailed )
    goto LABEL_181;
  v39 = v109;
  v36 = v119;
LABEL_53:
  v44 = v35 & 1;
  if( !v38 )
    v44 = v35;
  if( v44 && !MiChargeCommit(v36, 1ui64, v39) )
  {
    v82 = v119;
    v83 = 1i64;
    if( v119 != &Irp )
      goto LABEL_180;
    v84 = KeGetCurrentPrcb();
    v85 = (int)v84->CachedResidentAvailable;
    if( (_DWORD)v85 == -1 )
      goto LABEL_180;
    if( (unsigned __int64)(v85 + 1) <= 0x100 )
    {
      do
      {
        v86 = _InterlockedCompareExchange((volatile signed __int32 *)&v84->CachedResidentAvailable, v85 + 1, v85);
        v13 = (_DWORD)v85 == v86;
        LODWORD(v85) = v86;
        if( v13 )
          goto LABEL_181;
      }
      while( v86 != -1 && (unsigned __int64)(v86 + 1i64) <= 0x100 );
    }
    if( (int)v85 > 192
      && (_DWORD)v85 != -1
      && (_DWORD)v85 == _InterlockedCompareExchange((volatile signed __int32 *)&v84->CachedResidentAvailable, 192, v85) )
    {
      v83 = (int)v85 - 192 + 1i64;
    }
    if( v83 )
LABEL_180:
      _InterlockedExchangeAdd64((volatile signed __int64 *)&v82->Vp.ResidentAvailablePages, v83);
LABEL_181:
    v43 = MiChargeFailed;
    goto LABEL_60;
  }
  if( !v34 )
  {
    MiUnlinkPageFromList(v28, 0i64);
    v28->u2._bf_0 &= 0xC000000000000000ui64;
  }
  v45 = *((_BYTE *)&v28->u3 + 2);
  ++v28->u3.ReferenceCount;
  *((_BYTE *)&v28->u3 + 2) = v45 | 8;
  *((_BYTE *)&v28->u3 + 2) &= ~0x10u;
  if( (*(_DWORD *)(&v28->3 + 1) & 0x400i64) == 0 && (MiGetPagePrivilege((ULONG_PTR)v28, 1ui64, 0i64) & 0x10) != 0 )
    MiClearPfnImageVerified(v28, 0x1Cui64);
LABEL_60:
  _InterlockedAnd64(&v28->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  v12 = Mdl;
  if( v43 == MiChargeFailed )
  {
    v72 = 3;
    goto LABEL_115;
  }
  *((_QWORD *)&Mdl[1].Next + *p_ByteCount) = v124 / 48;
  ByteOffset = v12->ByteOffset;
  v47 = *p_ByteCount + 1;
  *p_ByteCount = v47;
  if( v43 != MiChargedGlobalNowLow || v47 < 0x10 && (*(_DWORD *)&KeGetCurrentThread()[1].gapD8[12] & 2) != 0 )
  {
    if( v47 == ByteOffset )
    {
      v72 = 1;
      goto LABEL_115;
    }
    SubsectionBase = v98;
    goto LABEL_67;
  }
  v72 = 2;
LABEL_115:
  MiUnlockProtoPoolPage(ProtoPagePfn[0], PageIrql[0]);
  SubsectionBase = v98;
  v23 = 17;
  PageIrql[0] = 17;
  if( v72 != 3 )
  {
    if( v72 == 2 || v96 == 1 || (v73 = v98 + 8, v98 + 8 >= v105) )
    {
      SubsectionBase = v98 + 8;
      v98 += 8i64;
    }
    else
    {
      v74 = MiExpandFlushMdl(v12, (unsigned int)((__int64)(v105 - v98) >> 3) + v96 - 1);
      if( v74 )
      {
        v75 = FlushEntry;
        if( v12 != (_MDL *)v126 && (!FlushEntry || v12 != (_MDL *)(FlushEntry + 20)) )
          ExFreePoolWithTag(v12, 0);
        Mdl = v74;
        v12 = v74;
        if( v75 )
          *((_QWORD *)v75 + 9) = v74;
        SubsectionBase += 8i64;
        v96 = v74->ByteOffset;
        v98 = v73;
        goto LABEL_70;
      }
      SubsectionBase += 8i64;
      v96 = v12->ByteOffset;
      v98 = v73;
    }
  }
LABEL_105:
  v10 &= ~4u;
  v59 = Subsection;
  *p_ByteCount <<= 12;
  LODWORD(v60) = MiReadyFlushMdlToWrite(v12, v59, (unsigned int)Flags);
  if( FlushEntry )
  {
    v87 = MiIssueAsynchronousFlush(
            FileObject,
            FlushEntry,
            (_MI_FLUSH_ARRAY *)P,
            v108,
            v60,
            ((unsigned int)Flags >> 2) & 4,
            IoPriorityThread,
            OpaqueContext);
    FlushEntry = v87;
    if( v87 )
    {
      v12 = (_MDL *)*((_QWORD *)v87 + 9);
      v96 = 16;
      goto LABEL_132;
    }
    v10 |= 1u;
    v100 = 0;
    goto LABEL_204;
  }
  v61 = ControlArea;
  v62 = MmGetPfnDb()[(__int64)v12[1].Next].PteLong | 0x8000000000000000ui64;
  LOBYTE(v63) = MiControlAreaUsingExtents((INT64)ControlArea);
  if( v63 )
    MiFlushFileOnlyMdl(v64, (_IO_STATUS_BLOCK *)v12);
  else
    MiIssueSynchronousFlush(FileObject, v12, v65, ((unsigned int)Flags >> 2) & 4, OpaqueContext, v101);
  MiUnlockFlushMdl(v12, v61, v101);
  v66 = v101;
  Status = (unsigned int)v101->Status;
  if( (int)Status >= 0 )
  {
    v102 = 0;
    if( v12 == (_MDL *)v126 )
    {
LABEL_110:
      v12->ByteCount = 0;
      goto LABEL_70;
    }
    v96 = 16;
    ExFreePoolWithTag(v12, 0);
    v12 = (_MDL *)v126;
LABEL_132:
    Mdl = v12;
    goto LABEL_110;
  }
  v98 = v62;
  SubsectionBase = v62;
  if( (_DWORD)Status == -1073741740 && (v10 & 0x10) != 0 )
  {
    v88 = (_LARGE_INTEGER *)&Mi10Milliseconds;
    goto LABEL_200;
  }
  v48 = *p_ByteCount;
  if( !MiIsRetryIoStatus(Status, *p_ByteCount) )
    goto LABEL_81;
  if( (--v102 & 0x1F) != 0 )
  {
    v88 = (_LARGE_INTEGER *)&Mi30Milliseconds;
LABEL_200:
    KeDelayExecutionThread(0, 0, v88);
LABEL_201:
    v66->Status = 0;
    v49 = 1;
    goto LABEL_82;
  }
  if( v96 != 1 && v48 > 0x1000 )
  {
    v96 = 1;
    goto LABEL_201;
  }
LABEL_81:
  v49 = 0;
LABEL_82:
  v100 = v49;
  if( v12 != (_MDL *)v126 )
  {
    if( v96 != 1 )
      v96 = 16;
    ExFreePoolWithTag(v12, 0);
    v12 = (_MDL *)v126;
    Mdl = (_MDL *)v126;
  }
  v12->ByteCount = 0;
  if( v49 )
  {
LABEL_70:
    LODWORD(v22) = ProtoPagePfn[0];
    goto LABEL_71;
  }
LABEL_84:
  if( v23 != 17 )
  {
    MiUnlockProtoPoolPage(ProtoPagePfn[0], v23);
    PageIrql[0] = 17;
  }
  v15 = Subsection;
LABEL_87:
  v50 = ((__int64)(SubsectionBase - v120) >> 3 << 12) + v99;
  v99 = v50;
  LOBYTE(v17) = ExAcquireSpinLockExclusive(SpinLock);
  if( !v15->NextSubsection
    && (_MMPTE *)SubsectionBase == &v15->SubsectionBase[v15->PtesInSubsection - (v15->_bf_34 & 0x3FFFFFFF)] )
  {
    MiEndingOffset(v15);
    v71 = v70 & 0xFFF;
    if( v71 )
    {
      v50 -= (unsigned int)(4096 - v71);
      v99 = v50;
    }
  }
  LODWORD(v51) = MiDecrementSubsectionViewCount((_MSUBSECTION *)v15);
  v53 = v51 + v104;
  v13 = *(_QWORD *)&v15[1].NumberOfFullSectors == 0i64;
  v104 += v51;
  if( v13 && (v15->u.SubsectionFlags._bf_2 & 1) == 0 )
  {
    LODWORD(v89) = MiInsertUnusedSubsection((_MSUBSECTION *)v15, v52);
    v53 += v89;
    v104 = v53;
  }
  if( (v10 & 8) == 0 )
  {
    if( v100 )
    {
      v20 = LastSubsectiona;
      if( v15 != LastSubsectiona )
      {
        v15 = v15->NextSubsection;
        Subsection = v15;
        if( v15 )
        {
          SubsectionBase = (unsigned __int64)v15->SubsectionBase;
          v19 = v99;
          v98 = SubsectionBase;
          goto LABEL_14;
        }
      }
    }
  }
LABEL_92:
  ExReleaseSpinLockExclusiveFromDpcLevel(SpinLock);
  __writecr8((unsigned __int8)v17);
  v54 = P;
  v55 = v108;
  if( P && !v108 )
  {
    MiWaitForAsynchronousFlushes((_MI_FLUSH_ARRAY *)P);
    if( v92 < 0 )
      LOBYTE(v10) = v10 | 1;
    ExFreePoolWithTag(v54, 0);
  }
  v56 = ControlArea;
  MiDereferenceControlAreaFile(ControlArea, FileObject);
  if( v53 )
    MiReturnCrossPartitionSectionCharges(
      *(_MI_CROSS_PARTITION_CHARGES **)(*(&stru_140C4DB30 + 267) + 8i64 * (v56->u1.Flags._bf_0 & 0x3FF)),
      1i64,
      v53);
  if( OpaqueContext )
    IoDiskIoAttributionDereference(OpaqueContext);
  KeLeaveCriticalRegionThread(&Thread->Tcb);
  if( (v10 & 1) != 0 )
  {
    LODWORD(IrpSpFlags) = Flags & 0xFFFFFFFB;
    return MiFlushSectionInternal(
             (_MMPTE *)ProtoPte,
             v122 - 1,
             FirstSubsectiona,
             LastSubsectiona,
             v55,
             IrpSpFlags,
             v101);
  }
  else
  {
    v57 = v101;
    if( (v10 & 8) != 0 )
    {
      result = -1073740749;
      v101->Status = -1073740749;
    }
    else
    {
      result = v101->Status;
    }
    v57->Information = v50;
  }
  return result;
}

Referenced by: