MiMarkHugePfnBad

NTSTATUS __stdcall MiMarkHugePfnBad(UINT64 a1, INT64 a2){
  _RTL_BALANCED_NODE *Root; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v4; 
  unsigned __int64 v5; 
  _QWORD *v7; 
  _MI_PARTITION *v8; 
  _MI_PARTITION *v9; 
  int v11; 
  _QWORD *v12; 
  VOID **PoolWithTag; 
  VOID **v14; 
  VOID **v15; 
  int v16; 
  _RTL_BALANCED_NODE *v17; 
  BOOL v18; 
  _RTL_BALANCED_NODE *v19; 
  _RTL_BALANCED_NODE *v20; 
  unsigned __int64 v21; 
  _RTL_BALANCED_NODE *v22; 
  unsigned __int64 v23; 
  unsigned __int8 v24; 
  __int64 v25; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  _RTL_BALANCED_NODE *P; 
  int v28; 
  _QWORD *v29; 
  _ETHREAD *Thread; 

  v28 = a2;
  Root = 0i64;
  memset(&LockHandle, 0, sizeof(LockHandle));
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0;
  v5 = (a1 >> 18) & 0x3FFFF;
  P = 0i64;
  Thread = CurrentThread;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&stru_140C4DB30 + 259, 0i64);
  v7 = (_QWORD *)(*(&stru_140C4DB30 + 272) + 8 * v5);
  while( 1 )
  {
    v8 = (_MI_PARTITION *)MiHugePfnPartition(v7);
    v9 = v8;
    if( !v8 )
    {
      if( (_InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 259, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((_EX_PUSH_LOCK *)&stru_140C4DB30 + 259);
      KeAbPostRelease((char *)&stru_140C4DB30 + 2072);
      KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
      return -1073740748;
    }
    MiLockDynamicMemoryExclusive(v8, CurrentThread);
    if( v9 == (_MI_PARTITION *)MiHugePfnPartition(v7) )
      break;
    MiUnlockDynamicMemoryExclusive(v9, CurrentThread);
  }
  if( (v9->Core.u.LongFlags & 1) != 0
    || (KeAcquireInStackQueuedSpinLock(&v9->PageLists.BadPageListHead.Lock, &LockHandle),
        LOBYTE(v11) = MiIsPageInHugePfn(a1),
        !v11) )
  {
LABEL_15:
    v4 = -1073740748;
    goto LABEL_16;
  }
  while( 1 )
  {
    v12 = (_QWORD *)(*(&stru_140C4DB30 + 272) + 8 * v5);
    v29 = v12;
    if( (*v12 & 0x10000000000i64) != 0 )
    {
      P = Root;
      Root = v9->PageLists.HugePfnBadPages.Root;
      while( Root )
      {
        v21 = (__int64)Root[1].Children[0] & 0x3FFFF;
        if( v5 > v21 )
        {
          Root = Root->Children[1];
        }
        else
        {
          if( v5 >= v21 )
            break;
          Root = Root->Children[0];
        }
      }
      v4 = (*v12 & 0x1C0000i64) != 0x100000 ? 0x103 : 0;
      goto LABEL_42;
    }
    if( Root )
      break;
    KeReleaseInStackQueuedSpinLock(&LockHandle);
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x10000ui64, 1883793741i64);
    v14 = PoolWithTag;
    if( !PoolWithTag )
    {
      v4 = -1073741670;
      goto LABEL_17;
    }
    memset(PoolWithTag, 0i64, 0x10000u);
    v15 = ExAllocatePoolWithTag(0x200ui64, 0x28ui64, 1883793741i64);
    Root = (_RTL_BALANCED_NODE *)v15;
    if( !v15 )
    {
      v17 = (_RTL_BALANCED_NODE *)v14;
      v4 = -1073741670;
      goto LABEL_18;
    }
    v15[3] = (VOID *)v5;
    v15[4] = v14;
    KeAcquireInStackQueuedSpinLock(&v9->PageLists.BadPageListHead.Lock, &LockHandle);
    LOBYTE(v16) = MiIsPageInHugePfn(a1);
    if( !v16 )
      goto LABEL_15;
  }
  v18 = 0;
  v19 = v9->PageLists.HugePfnBadPages.Root;
  if( !v19 )
    goto LABEL_34;
  while( v5 < ((unsigned __int64)v19[1].Children[0] & 0x3FFFF) )
  {
    v20 = v19->Children[0];
    if( !v19->Children[0] )
      goto LABEL_34;
LABEL_32:
    v19 = v20;
  }
  v20 = v19->Children[1];
  if( v20 )
    goto LABEL_32;
  v18 = 1;
LABEL_34:
  RtlAvlInsertNodeEx(&v9->PageLists.HugePfnBadPages.Root, (UINT64)v19, v18, Root);
  v12 = v29;
  *v29 |= 0x10000000000ui64;
LABEL_42:
  v22 = Root[1].Children[1];
  v23 = a1 & 0x3FFFF;
  if( !_bittest64((const signed __int64 *)v22, v23) )
  {
    _bittestandset64((signed __int64 *)v22, v23);
    v22 = Root[1].Children[1];
  }
  v24 = _bittest64((const signed __int64 *)&v22[1365].Children[1], v23);
  if( (v28 & 0x10000000) != 0 )
  {
    if( !v24 )
      _bittestandset64((signed __int64 *)&v22[1365].Children[1], v23);
  }
  else if( v24 )
  {
    _bittestandreset64((signed __int64 *)&v22[1365].Children[1], v23);
  }
  if( (((*(_DWORD *)v12 & 0x1C0000) - 0x40000i64) & 0xFFFFFFFFFFFBFFFFui64) == 0 )
  {
    v25 = MiHugePfnPartition(v12);
    MiUnlinkHugeRange(v25, v5);
    MiInsertHugeRangeInList(v5, 160, 0i64);
  }
LABEL_16:
  KeReleaseInStackQueuedSpinLock(&LockHandle);
LABEL_17:
  v17 = P;
LABEL_18:
  MiUnlockDynamicMemoryExclusive(v9, Thread);
  if( (_InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 259, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)&stru_140C4DB30 + 259);
  KeAbPostRelease((char *)&stru_140C4DB30 + 2072);
  KiLeaveGuardedRegionUnsafe((__int64)Thread);
  if( v17 )
    ExFreePoolWithTag(v17, 0);
  if( v4 == -1073740748 )
    KeDelayExecutionThread(0, 0, (_LARGE_INTEGER *)&Mi10Milliseconds);
  return v4;
}

Referenced by: