MiProbeAndLockPages

VOID __stdcall MiProbeAndLockPages(INT64 a1, CHAR a2, INT64 a3){
  _LOCK_OPERATION Operation; 
  char v6; 
  int v7; 
  int v8; 
  UINT64 *v9; 
  unsigned __int64 v10; 
  bool v11; 
  __int64 v12; 
  _DWORD *v13; 
  struct _KPRCB *CurrentPrcb; 
  volatile int DpcRequestSummary; 
  int v16; 
  _ETHREAD *NextThread; 
  NTSTATUS i; 
  unsigned __int64 v19; 
  _QWORD *v20; 
  _MMSUPPORT_INSTANCE *v21; 
  INT64 v22; 
  INT64 v23; 
  INT64 v24; 
  _MMVAD_SHORT *v25; 
  __int64 v26; 
  UINT64 v27; 
  int v28; 
  __int64 v29; 
  unsigned __int64 v30; 
  __int64 v31; 
  UINT64 v32; 
  UINT64 UpdateProcessLockedPages; 
  _MI_PROBE_PACKET Packet[52]; 
  UINT64 v35; 
  UINT64 v36; 

  Operation = (int)a3;
  memset(Packet, 0i64, 0xA8u);
  v6 = 0;
  LODWORD(UpdateProcessLockedPages) = 1;
  v7 = MiProbeAndLockPrepare(
         Packet,
         (_MDL *)a1,
         (VOID *)(*(_QWORD *)(a1 + 32) + *(unsigned int *)(a1 + 44)),
         *(unsigned int *)(a1 + 40),
         a2,
         Operation,
         UpdateProcessLockedPages);
  v8 = v7;
  if( v7 < 0 )
    RtlRaiseStatus(v7);
  v9 = *(UINT64 **)&Packet[4];
  v10 = *(_QWORD *)Packet;
  while( 1 )
  {
    v11 = (Packet[16] & 0x20) == 0;
    **(_QWORD **)&Packet[12] = -1i64;
    if( v11 )
      break;
    v26 = *(_QWORD *)&Packet[36];
    if( v10 > *(_QWORD *)&Packet[38] || v10 < *(_QWORD *)&Packet[36] )
      break;
    if( (v6 & 0x3F) != 0 || !MiProbePacketContended((INT64 *)Packet) )
    {
      if( *(_QWORD *)&Packet[40] == -1i64 )
      {
        v36 = *v9;
        v27 = v36;
        MiPteInShadowRange((UINT64)&v36);
        *(_QWORD *)&Packet[32] = (v27 >> 12) & 0xFFFFFFFFFi64;
      }
      else
      {
        *(_QWORD *)&Packet[32] = *(_QWORD *)&Packet[40] + ((v10 - v26) >> 12);
      }
LABEL_18:
      v8 = MiProbeLockFrame(Packet);
      if( v8 < 0 )
        goto LABEL_21;
      v20 = *(_QWORD **)&Packet[12];
      v10 = *(_QWORD *)Packet + 4096i64;
      *(_QWORD *)&Packet[12] += 8i64;
      v9 = (UINT64 *)(*(_QWORD *)&Packet[4] + 8i64);
      *(_QWORD *)&Packet[4] += 8i64;
      *v20 = *(_QWORD *)&Packet[32];
      *(_QWORD *)Packet = v10;
      goto LABEL_20;
    }
LABEL_45:
    MiUnlockProbePacketWorkingSet(Packet);
    MiLockProbePacketWorkingSet(Packet);
    v9 = *(UINT64 **)&Packet[4];
    v10 = *(_QWORD *)Packet;
LABEL_20:
    ++v6;
    if( (unsigned __int64)v9 > *(_QWORD *)&Packet[6] )
      goto LABEL_21;
  }
  if( (v6 & 0xF) != 0 )
    goto LABEL_14;
  v12 = *(_QWORD *)&Packet[24];
  if( *(_QWORD *)&Packet[8] && (unsigned int)MiPageTableLockIsContended(*(__int64 *)&Packet[24], *(UINT64 *)&Packet[8]) )
    goto LABEL_45;
  v13 = (*(_BYTE *)(v12 + 184) & 7) == 2 ? (_DWORD *)((char *)&stru_140C4DB30 + 6544) : (_DWORD *)(v12 + 192);
  if( (*v13 & 0x40000000) != 0 )
    goto LABEL_45;
  CurrentPrcb = KeGetCurrentPrcb();
  DpcRequestSummary = CurrentPrcb->DpcRequestSummary;
  if( (DpcRequestSummary & 1) != 0 )
  {
    v16 = 1;
    if( CurrentPrcb->DpcTimeCount <= 7 )
      goto LABEL_13;
    if( !CurrentPrcb->QuantumEnd )
      goto LABEL_64;
    v28 = 1;
  }
  else
  {
    v16 = 0;
    if( (DpcRequestSummary & 0x1E) != 0 )
    {
      v28 = 2;
      goto LABEL_44;
    }
    if( CurrentPrcb->QuantumEnd )
    {
      v28 = 3;
      goto LABEL_44;
    }
    NextThread = CurrentPrcb->NextThread;
    if( NextThread && NextThread != CurrentPrcb->CurrentThread )
    {
      v28 = 4;
      goto LABEL_44;
    }
LABEL_13:
    if( CurrentPrcb->DpcWatchdogCount <= 7u )
      goto LABEL_14;
    if( !v16 )
    {
LABEL_51:
      _disable();
      CurrentPrcb->DpcWatchdogCount = 0;
      CurrentPrcb->DpcTimeCount = 0;
      KiResetGlobalDpcWatchdogProfiler((INT64)CurrentPrcb);
      _enable();
      v28 = 0;
      goto LABEL_44;
    }
LABEL_64:
    if( (DpcRequestSummary & 0x1E) != 0 )
    {
      v28 = 5;
    }
    else
    {
      if( CurrentPrcb->CurrentThread == CurrentPrcb->IdleThread )
        goto LABEL_51;
      v28 = 6;
    }
  }
LABEL_44:
  if( v28 )
    goto LABEL_45;
LABEL_14:
  LODWORD(v35) = 0;
  for( i = MiLockPageLeafPageTable((INT64)Packet);
        *(_QWORD *)&Packet[10] != ZeroPte.u.Long;
        i = MiLockPageLeafPageTable((INT64)Packet) )
  {
    i = MiProbeLeafPteAccess((INT64)Packet, (UINT64)&v35);
    if( i < 0 )
      break;
    if( !(_DWORD)v35 )
    {
      v19 = *(_QWORD *)&Packet[10];
      MiPteInShadowRange((UINT64)&Packet[10]);
      *(_QWORD *)&Packet[32] = (v19 >> 12) & 0xFFFFFFFFFi64;
      MiSetProbePagesAhead((INT64)Packet);
      goto LABEL_18;
    }
    if( (_DWORD)v35 != 1 )
    {
      i = MiFaultInProbeAddress(Packet);
      if( i < 0 )
      {
        ++*(&stru_140C4DB30 + 611);
        break;
      }
    }
  }
  v8 = i;
  if( i >= 0 )
    goto LABEL_18;
LABEL_21:
  v21 = *(_MMSUPPORT_INSTANCE **)&Packet[24];
  if( *(_QWORD *)&Packet[8] )
    MiUnlockPageTableInternal(*(INT64 *)&Packet[24], *(UINT64 *)&Packet[8]);
  MiUnlockWorkingSetShared(v21, LOBYTE(Packet[17]));
  v24 = *(_QWORD *)&Packet[14];
  if( (MmTrackLockedPages & 1) != 0 )
    MiAddMdlTracker(
      *(_MDL **)&Packet[14],
      (*(unsigned int *)(*(_QWORD *)&Packet[14] + 40i64)
     + 4095i64
     + (unsigned __int64)((*(_DWORD *)(*(_QWORD *)&Packet[14] + 32i64) + *(_DWORD *)(*(_QWORD *)&Packet[14] + 44i64)) & 0xFFF)) >> 12,
      3ui64);
  if( v8 < 0 )
  {
    MmUnlockPages(v24, v22, v23);
    ++*(&stru_140C4DB30 + 620);
  }
  v25 = *(_MMVAD_SHORT **)&Packet[30];
  if( *(_QWORD *)&Packet[30] )
  {
    v29 = *(unsigned int *)(*(_QWORD *)&Packet[30] + 52i64);
    LODWORD(v29) = v29 & 0x7FFFFFFF;
    v30 = (*(_QWORD *)&Packet[26]
         + (v29 | ((unsigned __int64)*(unsigned __int8 *)(*(_QWORD *)&Packet[30] + 34i64) << 31))) >> 31;
    v31 = *(_QWORD *)&Packet[28];
    *(_DWORD *)(*(_QWORD *)&Packet[30] + 52i64) ^= (*(_DWORD *)(*(_QWORD *)&Packet[30] + 52i64) ^ (Packet[26]
                                                                                                 + (v29 | (*(unsigned __int8 *)(*(_QWORD *)&Packet[30] + 34i64) << 31)))) & 0x7FFFFFFF;
    v25->CommitChargeHigh = v30;
    v32 = v31 - *(_QWORD *)&Packet[26];
    if( v32 )
      MiReturnFullProcessCommitment(*(_EPROCESS **)&Packet[20], v32);
    MiUnlockAndDereferenceVad(v25);
  }
  if( v8 < 0 )
    RtlRaiseStatus(v8);
}

Referenced by: