MiHandleTransitionFault

NTSTATUS __stdcall MiHandleTransitionFault(){
  _MMPTE *v0; 
  UINT64 *v1; 
  _MMPFN *v2; 
  _UNICODE_STRING *v3; 
  _MMPTE *v4; 
  VOID **v5; 
  INT64 Vm; 
  _MMPFN *Pfn1; 
  int v8; 
  _MMVAD *v9; 
  unsigned __int64 v10; 
  int v11; 
  _MMVAD *Address; 
  unsigned __int64 v13; 
  VOID *v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  VOID *v17; 
  int v18; 
  _MMVAD *v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  int v24; 
  union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v26; 
  int v27; 
  UINT8 v28; 
  wchar_t *v29; 
  __int64 v30; 
  int v31; 
  __int64 v32; 
  UINT8 v33; 
  wchar_t *v34; 
  bool v35; 
  int v36; 
  int v37; 
  int v38; 
  UINT64 *v39; 
  _MMPFN *v40; 
  __int64 v41; 
  __int64 v42; 
  CHAR v43; 
  _MMPFN LockedProtoPfn; 
  UINT64 *VirtualAddress; 
  _QWORD *v46; 
  _MMPTE ComparePte; 
  __int64 *v48; 

  VirtualAddress = v1;
  v4 = v0;
  v5 = (VOID **)v1;
  LockedProtoPfn.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::gap0[0] = 0;
  Vm = (INT64)v3;
  *v48 = 0i64;
  Pfn1 = v2;
  *v46 = 0i64;
  LOBYTE(v8) = MI_PFN_IS_PROTO(v3, 0i64, (UINT8)v2, &v3->Length);
  v11 = v8;
  if( !v8 )
  {
    v10 = *(_QWORD *)(v10 + 8);
    if( v4 != (_MMPTE *)(v10 | 0x8000000000000000ui64) )
      KeBugCheckEx(0x1Au, (PVOID)0x888A, v4, (PVOID)v10, (PVOID)Vm);
  }
  Address = v9;
  v13 = *(_QWORD *)(Vm + 16);
  v14 = *v5;
  v15 = v13 >> 11;
  v16 = v13 >> 3;
  if( (*(_QWORD *)(Vm + 16) & 0x400i64) != 0 )
    v16 = (unsigned int)v15;
  if( (v16 & 1) != 0 )
  {
    if( (unsigned __int64)v14 <= 0x7FFFFFFEFFFFi64 && !v11 )
      Address = MiLocateAddress(*v5);
    LODWORD(v17) = MiMakeTransitionHeatBatch(Vm);
    v5[14] = v17;
    if( v17 )
    {
LABEL_25:
      _InterlockedAnd64((volatile signed __int64 *)(Vm + 24), 0x7FFFFFFFFFFFFFFFui64);
      if( Pfn1 )
      {
        MiUnlockProtoPoolPage((ULONG_PTR)Pfn1, 0x11u);
        return -1073740748;
      }
      return -1073740748;
    }
  }
  LOBYTE(v18) = MI_PFN_IS_PROTO((_UNICODE_STRING *)Vm, (_UNICODE_STRING *)v16, (UINT8)Address, (PWCHAR)v10);
  if( !v18 )
    goto LABEL_23;
  v20 = *(_QWORD *)(Vm + 16);
  if( (v20 & 0x400) == 0 || ((*(_QWORD *)(Vm + 40) >> 60) & 7) == 3 )
    goto LABEL_23;
  v21 = *(_QWORD *)(Vm + 16);
  if( *(&stru_140C4DB30 + 42) && (v20 & 0x10) == 0 )
    v21 = ~*(&stru_140C4DB30 + 42) & v20;
  v22 = v21 >> 16;
  if( (*(_DWORD *)(*(_QWORD *)v22 + 56i64) & 0x20) == 0 )
    goto LABEL_23;
  v23 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)v22 + 96i64) + 40i64);
  if( !v23 || (v23 & 0xFFFFFFFFFFFFFFF8ui64) == 8 || (v23 & 3) == 2 )
    goto LABEL_23;
  if( (unsigned __int64)v14 < 0xFFFF800000000000ui64 )
  {
    if( Address )
    {
LABEL_30:
      v26.LongFlags = (unsigned int)v19->Core.u;
      if( (v26.LongFlags & 0x70) != 32
        || (v26.LongFlags & 0xF80) != 128
        && ((v19->u2.LongFlags2 & 0x8000000) == 0 || (v23 & 4) != 0)
        && ((MiFlags & 0x400) == 0 || (*(_BYTE *)(v22 + 34) & 2) == 0) )
      {
        goto LABEL_36;
      }
LABEL_23:
      MiUnlinkPageFromList((_MMPFN *)Vm, 0i64);
      if( !v24 )
      {
        MiDiscardTransitionPteEx((_MMPFN *)Vm, 0i64);
        goto LABEL_25;
      }
      LOBYTE(v27) = MiIsPfnFileOnly(Vm);
      if( v27 )
      {
LABEL_71:
        v42 = *(_QWORD *)(Vm + 24);
        ++*(_WORD *)(Vm + 32);
        *(_QWORD *)(Vm + 24) = v42 & 0xC000000000000000ui64 | 1;
        *(_BYTE *)(Vm + 34) = *(_BYTE *)(Vm + 34) & 0xF8 | 6;
        return 0;
      }
      v30 = 1i64;
      if( (unsigned __int64)v14 > 0x7FFFFFFEFFFFi64 || *(_WORD *)(Vm + 32) )
        goto LABEL_63;
      LOBYTE(v31) = MI_PFN_IS_PROTO(
                      (_UNICODE_STRING *)Vm,
                      (_UNICODE_STRING *)KeGetCurrentThread()->ApcState.Process->Vm.Instance.VmWorkingSetList,
                      v28,
                      v29);
      if( v31 )
      {
        if( (*(_DWORD *)(Vm + 16) & 0x400i64) != 0 )
          goto LABEL_63;
        v35 = *(_QWORD *)(v32 + 432) == 0i64;
      }
      else
      {
        v35 = *(_QWORD *)(v32 + 424) == 0i64;
      }
      if( !v35 )
      {
        if( (Address || (Address = MiLocateAddress(v14)) != 0i64)
          && MiVadPageSizes[(Address->Core.u.LongFlags >> 18) & 3] == 16 )
        {
          LOBYTE(v36) = MI_PFN_IS_PROTO((_UNICODE_STRING *)Vm, (_UNICODE_STRING *)Address->Core.u.LongFlags, v33, v34);
          v38 = v37 & 0x100000;
          if( v36 )
          {
            if( !v38 )
            {
LABEL_54:
              v39 = VirtualAddress;
              v40 = MiIdealClusterPage(
                      VirtualAddress,
                      Address,
                      v4,
                      ComparePte,
                      (_MMSUPPORT_INSTANCE *)Vm,
                      Pfn1,
                      &LockedProtoPfn,
                      v43,
                      (UINT8 *)LockedProtoPfn.ListEntry.Flink);
              v30 = (__int64)v40;
              if( v40 )
              {
                if( (_MMPFN *)Vm != v40 )
                {
                  Vm = (INT64)v40;
                  *v46 = v40;
                }
              }
              else
              {
                _InterlockedAnd64((volatile signed __int64 *)(Vm + 24), 0x7FFFFFFFFFFFFFFFui64);
                if( Pfn1 )
                  MiUnlockProtoPoolPage((ULONG_PTR)Pfn1, 0x11u);
              }
              goto LABEL_60;
            }
          }
          else if( v38 )
          {
            goto LABEL_54;
          }
        }
        v39 = VirtualAddress;
LABEL_60:
        if( LockedProtoPfn.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::gap0[0] )
          goto LABEL_65;
        if( !v30 )
          goto LABEL_66;
LABEL_64:
        v30 = (__int64)MiMigratePfn(v39, Vm, (__int64)Pfn1, v48);
        *v46 = v30;
        Vm = v30;
LABEL_65:
        if( !v30 )
        {
LABEL_66:
          v41 = *v48;
          if( *v48 )
          {
            if( *(int *)(v41 + 176) > 1 )
              KeSetEvent((PRKEVENT)(v41 + 56), 0, 0);
            MiFreeInPageSupportBlock((_MMINPAGE_SUPPORT *)v41);
            *v48 = 0i64;
          }
          return -1073740748;
        }
        goto LABEL_71;
      }
LABEL_63:
      v39 = VirtualAddress;
      goto LABEL_64;
    }
    v19 = MiLocateAddress(v14);
  }
  else if( (MiFlags & 0x10000) == 0 || (v20 & 0x40) == 0 )
  {
    goto LABEL_23;
  }
  if( v19 )
    goto LABEL_30;
LABEL_36:
  _InterlockedAnd64((volatile signed __int64 *)(Vm + 24), 0x7FFFFFFFFFFFFFFFui64);
  if( Pfn1 )
    MiUnlockProtoPoolPage((ULONG_PTR)Pfn1, 0x11u);
  return -1073740760;
}

Referenced by: