MiActivePageClaimCandidate

VOID __fastcall MiActivePageClaimCandidate(_MI_PARTITION *Partition, _MMPFN *Pfn1, UINT64 PageLockHeld, UINT64 Pass){
  int v4; 
  _LIST_ENTRY *Blink; 
  __int64 v8; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  _MMPFN *BaseResidentPage; 
  NTSTATUS PfnPageSizeIndex; 
  _MMPFN *v13; 
  unsigned int v14; 
  __int64 *v15; 
  _RTL_BITMAP_EX *LargePfnBitMap; 
  int v17; 
  _UNICODE_STRING *v18; 
  UINT8 v19; 
  wchar_t *v20; 
  int v21; 
  INT64 v22; 
  unsigned __int64 EntireField; 
  unsigned __int64 PteBase; 
  __int64 v25; 
  unsigned __int64 PdeBase; 
  unsigned __int64 v27; 
  int v28; 
  INT64 a2; 
  INT64 a3; 

  LODWORD(a3) = Pass;
  v4 = PageLockHeld;
  Blink = Pfn1->ListEntry.Blink;
  v8 = (unsigned __int128)(((char *)Pfn1 - (char *)MmGetPfnDb()) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
  v9 = ((unsigned __int64)v8 >> 63) + (v8 >> 3);
  v10 = (unsigned __int64)Blink | 0x8000000000000000ui64;
  if( (*((_BYTE *)&Pfn1->u3 + 3) & 8) == 0 )
  {
    if( (Pfn1->u4._bf_0 & 0x1000000000i64) == 0 )
      goto LABEL_8;
    if( (_DWORD)PageLockHeld == 1 )
    {
      BaseResidentPage = MiGetBaseResidentPage(Pfn1);
      PfnPageSizeIndex = MiGetPfnPageSizeIndex((INT64)BaseResidentPage);
      if( v13 != Pfn1 )
        _InterlockedAnd64(&v13->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    }
    else
    {
      LODWORD(a2) = 0;
      LODWORD(a3) = 0;
      PfnPageSizeIndex = MiGetPfnPageSizeIndexUnsynchronized(Pfn1, &a2, &a3);
    }
    if( PfnPageSizeIndex == -1 )
    {
LABEL_8:
      if( *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)Pfn1->u4._bf_0 >> 39) & 0x3FF)) == Partition )
      {
        if( Partition->PageLists.PfnBitMapsReady )
        {
          v14 = 0;
          v15 = MiLargePageSizes;
          LargePfnBitMap = Partition->PageLists.LargePfnBitMap;
          while( !LargePfnBitMap->SizeOfBitMap
               || !_bittest64((const signed __int64 *)LargePfnBitMap->Buffer, v9 / *v15) )
          {
            ++v14;
            ++LargePfnBitMap;
            ++v15;
            if( v14 >= 2 )
              goto LABEL_14;
          }
        }
        else
        {
LABEL_14:
          LOBYTE(v17) = MiIsPfnFromSlabAllocation((INT64)Pfn1);
          if( !v17 )
          {
            LOBYTE(v21) = MI_PFN_IS_PROTO((_UNICODE_STRING *)Pfn1, v18, v19, v20);
            if( v21 )
            {
              if( (Pfn1->u2._bf_0 & 0x4000000000000000i64) == 0
                && v10 != *(&stru_140C4DB30 + 9)
                && v10 != *(&stru_140C4DB30 + 10)
                && v4 == 1 )
              {
                MiIsPfnFileOnly(v22);
              }
            }
            else if( v10 != -8i64 && MiGetSystemRegionType(v10) != 5 )
            {
              EntireField = Pfn1->u4.EntireField;
              if( ((EntireField >> 60) & 7) != 1 && (EntireField & 0xFFFFFFFFFi64) != 0xFFFFFFFFDi64 )
              {
                PteBase = (unsigned __int64)MmGetPteBase();
                if( v10 >= PteBase && v10 <= (unsigned __int64)MmGetPteLimit() )
                {
                  v25 = (__int64)((v10 << 25) - (PteBase << 25)) >> 16;
                  if( (Pfn1->$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::gap0[0] & 1) != 0 )
                  {
                    if( !PsInitialSystemProcess || v9 != PsInitialSystemProcess->Pcb.DirectoryTableBase >> 12 )
                    {
                      PdeBase = (unsigned __int64)MmGetPdeBase();
                      v27 = PdeBase + 536870904;
                      v28 = 0;
                      while( v10 < PdeBase || v10 > v27 )
                      {
                        PdeBase = PteBase + ((PdeBase >> 9) & 0x7FFFFFFFF8i64);
                        v27 = PteBase + ((v27 >> 9) & 0x7FFFFFFFF8i64);
                        if( (unsigned int)++v28 >= 3 )
                        {
                          if( (EntireField & 0xFFFFFFFFFi64) != v9
                            && (Pfn1->u2._bf_0 & 0x3FFFFFFFFFFFFFFFui64) > 1
                            && MiGetSystemRegionType(v25) != 6 )
                          {
                            MiHyperPage(Pfn1);
                          }
                          return;
                        }
                      }
                    }
                  }
                  else if( MiHyperPage(Pfn1) == TypeMismatch
                         && !MiVaIsPageFileHash(*(VOID **)(*(&stru_140C4DB30 + 267) + 8 * ((EntireField >> 39) & 0x3FF)))
                         && MiGetSystemRegionType(v25) == 5
                         && (*((_BYTE *)&Pfn1->u3 + 3) & 0x10) == 0
                         && Pfn1->u3.ReferenceCount <= 1u
                         && (MiFlags & 0x800) == 0
                         && v4 == 1 )
                  {
                    MI_READ_PTE_LOCK_FREE(v10);
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Referenced by: