VmpAccessFaultBatchResolve

void __fastcall VmpAccessFaultBatchResolve(_QWORD *a1, unsigned int a2, __int64 a3, int a4, char a5, int a6){
  char v6; 
  __int64 v8; 
  INT64 *v9; 
  unsigned int v10; 
  int v11; 
  int v12; 
  int v13; 
  int v14; 
  int v15; 
  _QWORD *v16; 
  unsigned int v17; 
  __int64 v18; 
  _QWORD *i; 
  __int64 v20; 
  __int64 v21; 
  INT64 v22; 
  __int64 v23; 
  INT64 v24; 
  int v25; 
  INT64 *v26; 
  CHAR *PageFrameNumber; 
  INT64 v28; 
  _QWORD *v29; 
  INT64 VirtualAddress; 
  INT64 v31; 
  CHAR v32; 
  INT64 v33; 

  v31 = 0i64;
  v6 = a4;
  HIDWORD(v28) = a4;
  v8 = a2;
  if( a3 )
  {
    v9 = *(INT64 **)(a3 + 16);
    v10 = *(_DWORD *)a3;
  }
  else
  {
    v9 = &v33;
    v10 = 16;
  }
  v11 = v6 & 1 | 2;
  v12 = v6 & 2;
  if( (v6 & 2) == 0 )
    v11 = v6 & 1;
  LODWORD(v28) = v6 & 4;
  if( (v6 & 4) != 0 )
    v11 |= 1u;
  v13 = v11 | 8;
  if( (v6 & 8) == 0 )
    v13 = v11;
  v14 = v13 | 0x10;
  if( (v6 & 0x10) == 0 )
    v14 = v13;
  HIDWORD(PageFrameNumber) = v6 & 0x20;
  v15 = v14 | 0x20;
  if( (v6 & 0x20) == 0 )
    v15 = v14;
  v16 = &a1[6 * v8];
  LODWORD(PageFrameNumber) = v15;
  v17 = 0;
  LOWORD(v29) = (_WORD)a1 + 48 * v8;
  while( a1 < v16 )
  {
    v18 = a1[3] & 0xFFFFFFFFFFFFFi64;
    VirtualAddress = a1[3] << 12;
    if( !v17 )
    {
      v17 = 1;
      for( i = a1 + 6; i < v16; i += 6 )
      {
        if( v17 >= v10 )
          break;
        v20 = i[3] & 0xFFFFFFFFFFFFFi64;
        if( v20 != v18 + 1 )
          break;
        v18 = v20;
        ++v17;
      }
      if( (v6 & 0x40) != 0 && v17 == 512 )
      {
        LODWORD(v21) = MmGetNodeFastLargePageCounts((INT64)i, (unsigned int)(a6 - 1));
        if( !v21 )
          MmBuildLargePages(v22, (unsigned int)(a6 - 1));
      }
    }
    v23 = v17;
    v31 = v17 << 12;
    memset(v9, 0i64, 8 * v17);
    MmVirtualAccessFault(
      &VirtualAddress,
      (UINT64)v9,
      (UINT64 *)(unsigned int)PageFrameNumber,
      v24,
      PageFrameNumber,
      v28,
      (INT16)v29,
      VirtualAddress,
      v31,
      v32,
      v33);
    if( v25 >= 0 )
    {
      v26 = v9;
      if( v9 < &v9[v23] )
      {
        do
        {
          if( (*v26 & 0x10000000000000i64) == 0 )
            break;
          a1[5] = *v26 & 0xFFFFFFFFFFFFFi64;
          if( v12 || (*v26 & 0x20000000000000i64) != 0 && (a5 & 2) != 0 )
            a1[4] |= 0x10000000000000ui64;
          if( (_DWORD)v28 )
            a1[4] |= 0x20000000000000ui64;
          if( (*v26 & 0x80000000000000i64) != 0 )
            a1[4] |= 0x40000000000000ui64;
          ++v26;
          a1 += 6;
          --v17;
        }
        while( v26 < &v9[v23] );
        v6 = BYTE4(v28);
        v16 = v29;
      }
    }
    else
    {
      if( !HIDWORD(PageFrameNumber) )
        return;
      a1[4] |= 0x100000000000000ui64;
      a1 += 6;
      v17 = 0;
      v10 = 1;
    }
  }
}

Referenced by:

VmpAccessFaultBatch