MiReturnSystemCharges

NTSTATUS __stdcall MiReturnSystemCharges(INT64 a1, UINT64 a2, INT64 a3){
  unsigned __int64 v3; 
  unsigned __int64 v4; 
  _MI_PARTITION *v5; 
  struct _KPRCB *CurrentPrcb; 
  __int64 CachedResidentAvailable; 
  bool v8; 
  _MM_SESSION_SPACE *Session; 

  v3 = a2;
  switch( (_DWORD)a3 )
  {
    case 1:
      goto LABEL_15;
    case 2:
      goto LABEL_6;
    case 0xB:
LABEL_15:
      Session = KeGetCurrentThread()->ApcState.Process->Session;
      _InterlockedExchangeAdd64((volatile signed __int64 *)Session + 5, -(__int64)v3);
      _InterlockedExchangeAdd64((volatile signed __int64 *)Session + 6, -(__int64)v3);
      goto LABEL_6;
  }
  v4 = -(__int64)a2;
  if( (_DWORD)a3 == 4 )
    _InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 573, v4);
  else
    _InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 570, v4);
LABEL_6:
  v5 = &Irp;
  if( (_MI_PARTITION *)a1 == &Irp )
  {
    CurrentPrcb = KeGetCurrentPrcb();
    CachedResidentAvailable = (int)CurrentPrcb->CachedResidentAvailable;
    if( (_DWORD)CachedResidentAvailable != -1 )
    {
      for( ; v3 + CachedResidentAvailable <= 0x100; LODWORD(v5) = v3 + (_DWORD)v5 )
      {
        if( v3 >= 0x80000 )
          break;
        LODWORD(v5) = _InterlockedCompareExchange(
                        (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                        CachedResidentAvailable + v3,
                        CachedResidentAvailable);
        v8 = (_DWORD)CachedResidentAvailable == (_DWORD)v5;
        CachedResidentAvailable = (int)v5;
        if( v8 )
          return(int)v5;
        if( (_DWORD)v5 == -1 )
          break;
      }
      if( (int)CachedResidentAvailable > 192 && (_DWORD)CachedResidentAvailable != -1 )
      {
        LODWORD(v5) = _InterlockedCompareExchange(
                        (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                        192,
                        CachedResidentAvailable);
        if( (_DWORD)CachedResidentAvailable == (_DWORD)v5 )
        {
          LODWORD(v5) = CachedResidentAvailable - 192;
          v3 += (int)CachedResidentAvailable - 192;
        }
      }
    }
  }
  if( v3 )
    _InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 7168), v3);
  return(int)v5;
}

Referenced by: