MiProcessTransitionHeatBatch

NTSTATUS __stdcall MiProcessTransitionHeatBatch(INT64 a1){
  _ETHREAD *CurrentThread; 
  _ETHREAD *v3; 
  __int64 v4; 
  __int64 AbOrphanedEntrySummary; 
  char v6; 
  NTSTATUS SessionId; 
  bool v8; 
  _QWORD *i; 
  unsigned __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  unsigned __int64 v13; 
  union {$8D9ED47C9F2F2CD645B633E301950288 __s0;unsigned __int64 EntireField;} *p_u4; 
  NTSTATUS result; 
  UINT64 a3; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.SpecialApcDisable;
  LODWORD(a3) = 0;
  v3 = (_ETHREAD *)KeGetCurrentThread();
  --v3->Tcb.SpecialApcDisable;
  if( ++v3->Tcb.AbAllocationRegionCount != 1 )
  {
    v4 = 0i64;
    goto LABEL_3;
  }
  LOBYTE(AbOrphanedEntrySummary) = v3->Tcb.AbEntrySummary;
  if( !(_BYTE)AbOrphanedEntrySummary )
  {
    if( !v3->Tcb.AbOrphanedEntrySummary )
    {
      v4 = 0i64;
      goto LABEL_3;
    }
    AbOrphanedEntrySummary = v3->Tcb.AbOrphanedEntrySummary;
    v3->Tcb.AbOrphanedEntrySummary = 0;
    LOBYTE(AbOrphanedEntrySummary) = v3->Tcb.AbEntrySummary | AbOrphanedEntrySummary;
  }
  v6 = AbOrphanedEntrySummary;
  _BitScanForward((unsigned int *)&AbOrphanedEntrySummary, (unsigned __int8)AbOrphanedEntrySummary);
  v3->Tcb.AbEntrySummary = v6 & ~(1 << AbOrphanedEntrySummary);
  v4 = (__int64)&v3->Tcb.LockEntries[AbOrphanedEntrySummary];
  if( !v4 )
  {
LABEL_3:
    _interlockedbittestandset((volatile signed __int32 *)&v3->Tcb.116 + 1, 0x10u);
    goto LABEL_14;
  }
  if( (unsigned __int64)&stru_140C50B28 + 88 >= 0xFFFF800000000000ui64
    && *((_BYTE *)&stru_140C4DB30 + ((((unsigned __int64)&stru_140C50B28 + 88) >> 39) & 0x1FF) + 6872) == 1 )
  {
    SessionId = MmGetSessionIdEx(v3->Tcb.ApcState.Process);
  }
  else
  {
    SessionId = -1;
  }
  *(_DWORD *)(v4 + 40) = SessionId;
  *(_QWORD *)(v4 + 32) = ((unsigned __int64)&stru_140C50B28 + 88) & 0x7FFFFFFFFFFFFFFCi64;
LABEL_14:
  --v3->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&v3->Tcb, (char *)&stru_140C50B28 + 88, &a3);
  v8 = v3->Tcb.SpecialApcDisable++ == -1;
  if( v8 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v3->Tcb.ApcState.ApcListHead[0].Flink != &v3->Tcb.152 )
    KiCheckForKernelApcDelivery();
  if( !_InterlockedCompareExchange64((_QWORD *)&stru_140C50B28 + 11, 17i64, 0i64)
    || ExfTryAcquirePushLockShared((_EX_PUSH_LOCK *)&stru_140C50B28 + 11) )
  {
    if( v4 )
      *(_BYTE *)(v4 + 26) |= 1u;
    for( i = (_QWORD *)(a1 + 16); ; ++i )
    {
      if( (unsigned __int64)i >= a1 + 16 + 8 * (unsigned __int64)*(unsigned int *)(a1 + 4) )
      {
        MiNotifyPageHeat((INT64 *)a1);
        goto LABEL_34;
      }
      v10 = *i >> 12;
      v11 = (*i & 0x3FFi64) + 1;
      v12 = (*i >> 10) & 3i64;
      if( ((*i >> 10) & 3) != 0 )
      {
        do
        {
          v11 <<= 9;
          v10 >>= 9;
          LODWORD(v12) = v12 - 1;
        }
        while( (_DWORD)v12 );
      }
      v13 = v11 + v10;
      if( v10 < v11 + v10 )
        break;
LABEL_31:
      ;
    }
    p_u4 = &MmGetPfnDb()[v10].u4;
    while( v10 <= 0xFFFFFFFFFi64 && (((unsigned __int64)p_u4->_bf_0 >> 50) & 1) != 0 )
    {
      ++v10;
      p_u4 += 6;
      if( v10 >= v13 )
        goto LABEL_31;
    }
LABEL_34:
    if( _InterlockedCompareExchange64((_QWORD *)&stru_140C50B28 + 11, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared((_EX_PUSH_LOCK *)&stru_140C50B28 + 11);
    KeAbPostRelease((char *)&stru_140C50B28 + 88);
  }
  else if( v4 )
  {
    KeAbPostReleaseEx((char *)&stru_140C50B28 + 88, (VOID *)v4);
  }
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return result;
}

Referenced by: