MiUpdateLargePageCandidates

NTSTATUS __stdcall MiUpdateLargePageCandidates(UINT64 a1, INT64 a2, INT64 a3){
  __int64 v4; 
  __int64 v5; 
  UINT64 v6; 
  unsigned __int64 v7; 

  v4 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)MmGetPfnDb()[a1].u4._bf_0 >> 39) & 0x3FF));
  if( !*(_BYTE *)(v4 + 4830) )
    return 0;
  if( (_DWORD)a2 == 2 )
  {
    v5 = 32i64;
    v6 = a1 >> 9;
    v7 = a1 >> 18;
  }
  else
  {
    if( (_DWORD)a2 != 1 )
      return 0;
    v5 = 512i64;
    v6 = a1 >> 18;
    v7 = a1 >> 18;
  }
  if( a3 <= 0 )
  {
    if( (_DWORD)a2 == 2 )
      --*(_BYTE *)(*(_QWORD *)(v4 + 5104) + v6);
    else
      --*(_WORD *)(*(_QWORD *)(v4 + 5128) + 2 * v6);
    return 0;
  }
  if( (_DWORD)a2 == 2 )
  {
    if( (unsigned __int8)++*(_BYTE *)(v6 + *(_QWORD *)(v4 + 5104)) != v5 )
      return 0;
    _bittestandset64(*(signed __int64 **)(v4 + 5120), v7);
    return 1;
  }
  else
  {
    ++*(_WORD *)(*(_QWORD *)(v4 + 5128) + 2 * v6);
    if( *(_WORD *)(2 * v6 + *(_QWORD *)(v4 + 5128)) != 512 || ((unsigned __int64)KeFeatureBits & 0x2000000000i64) == 0 )
      return 0;
    _InterlockedCompareExchange((volatile signed __int32 *)(v4 + 5136), 1, 0);
    return 1;
  }
}

Referenced by: