MiRemoveLockedPageChargeAndDecRef

NTSTATUS __stdcall MiRemoveLockedPageChargeAndDecRef(_MMPFN *Pfn1){
  wchar_t *v1; 
  unsigned __int16 ReferenceCount; 
  bool v4; 
  unsigned __int16 v5; 
  int v6; 
  unsigned __int64 PteBase; 
  __int64 bf_0; 
  __int64 v9; 
  __int64 v10; 
  int v11; 
  unsigned __int64 v12; 
  char v13; 
  int v14; 
  _MMPFN *v15; 
  unsigned __int64 v16; 
  int v17; 
  int v18; 
  __int64 v19; 
  _MI_PARTITION *v20; 
  struct _KPRCB *CurrentPrcb; 
  __int64 CachedResidentAvailable; 
  signed __int32 v23; 

  ReferenceCount = Pfn1->u3.ReferenceCount;
  if( !ReferenceCount )
    MiBadRefCount(Pfn1);
  v4 = ReferenceCount == 1;
  v5 = ReferenceCount - 1;
  Pfn1->u3.ReferenceCount = v5;
  if( v4 )
  {
    LOBYTE(v6) = MiIsPfnFileOnly((INT64)Pfn1);
    if( v6 )
      goto LABEL_42;
  }
  bf_0 = Pfn1->u4._bf_0;
  if( (bf_0 & 0x1000000000i64) == 0 && (bf_0 & 0x2000000000000i64) == 0 )
  {
    v9 = Pfn1->u2._bf_0;
    v10 = v9 & 0x3FFFFFFFFFFFFFFFi64;
    if( !v5 )
    {
      v11 = 1;
LABEL_15:
      PteBase = (unsigned __int64)MmGetPteBase();
      v12 = Pfn1->PteLong | 0x8000000000000000ui64;
      if( v12 > PteBase + 0x3FFFFFFF78i64 || v12 < PteBase )
      {
        v13 = *((_BYTE *)&Pfn1->u3 + 3);
        if( (v13 & 0x20) != 0 )
        {
          *((_BYTE *)&Pfn1->u3 + 3) = v13 & 0xDF;
          goto LABEL_41;
        }
      }
      LOBYTE(v14) = MI_PFN_IS_PROTO((_UNICODE_STRING *)Pfn1, (_UNICODE_STRING *)0x8000000000000000i64, PteBase, v1);
      if( v14 && (*(_DWORD *)(&Pfn1->3 + 1) & 0x400i64) != 0 )
      {
        v17 = 1;
      }
      else
      {
        MiIsPfnCommitNotCharged(v15);
        if( v18 )
        {
          v17 = 1;
        }
        else if( v11 == 1 && (v9 & 0x4000000000000000i64) != 0 )
        {
          v17 = 1;
        }
      }
      v19 = (v16 >> 39) & 0x3FF;
      v20 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * v19);
      if( v17 == 1 )
        MiReturnCommit(*(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * v19), 1ui64);
      PteBase = 1i64;
      if( v20 == &Irp )
      {
        CurrentPrcb = KeGetCurrentPrcb();
        CachedResidentAvailable = (int)CurrentPrcb->CachedResidentAvailable;
        if( (_DWORD)CachedResidentAvailable != -1 )
        {
          if( (unsigned __int64)(CachedResidentAvailable + 1) <= 0x100 )
          {
            while( 1 )
            {
              v23 = _InterlockedCompareExchange(
                      (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                      CachedResidentAvailable + 1,
                      CachedResidentAvailable);
              v4 = (_DWORD)CachedResidentAvailable == v23;
              LODWORD(CachedResidentAvailable) = v23;
              if( v4 )
                break;
              if( v23 == -1 || (unsigned __int64)(v23 + 1i64) > 0x100 )
                goto LABEL_35;
            }
LABEL_41:
            if( v11 )
            {
LABEL_42:
              MiPfnReferenceCountIsZero(Pfn1, Pfn1 - MmGetPfnDb(), PteBase);
              return 1;
            }
            return 0;
          }
LABEL_35:
          if( (int)CachedResidentAvailable > 192
            && (_DWORD)CachedResidentAvailable != -1
            && (_DWORD)CachedResidentAvailable == _InterlockedCompareExchange(
                                                    (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                                                    192,
                                                    CachedResidentAvailable) )
          {
            PteBase = (int)CachedResidentAvailable - 192 + 1i64;
          }
          if( !PteBase )
            goto LABEL_41;
        }
      }
      LOBYTE(PteBase) = _InterlockedExchangeAdd64((volatile signed __int64 *)&v20->Vp.ResidentAvailablePages, PteBase);
      goto LABEL_41;
    }
    if( v5 == 1 )
    {
      if( v10 )
      {
LABEL_13:
        v11 = 0;
        goto LABEL_15;
      }
    }
    else if( v5 != 2 || !v10 )
    {
      return 0;
    }
    if( (*(_BYTE *)(&Pfn1->u3 + 1) & 8) == 0 )
      return 0;
    goto LABEL_13;
  }
  return 0;
}

Referenced by: