MiLinkPoolCommitChain

CHAR __stdcall MiLinkPoolCommitChain(INT64 a1, UINT64 a2){
  UINT64 v2; 
  UINT64 v3; 
  UINT64 v5; 
  __int64 CurrentThread; 
  _MMPTE *i; 
  _MMPTE v8; 
  __int64 v9; 
  __int64 v10; 
  int v11; 
  _MMPTE *PteBase; 
  _MMPTE *v13; 
  __int64 v14; 
  __int64 v15; 
  void *v16; 
  char *v17; 
  __int64 v18; 
  INT64 v19; 
  INT64 v20; 
  int v21; 
  INT64 v22; 
  UINT64 BitsMustBeChanged; 

  v2 = a2;
  v3 = (a2 & 0xFFFFFFFFFFFFF000ui64) + 4088;
  if( v3 > *(_QWORD *)(a1 + 56) )
    v3 = *(_QWORD *)(a1 + 56);
  if( (*(_BYTE *)(a1 + 78) & 4) != 0 )
  {
    PteBase = MmGetPteBase();
    v13 = (_MMPTE *)((char *)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64));
    MI_READ_PTE_LOCK_FREE((INT64)v13);
    v14 = MiSwizzleInvalidPte(768i64);
    if( v15 != v14 && MiIsPoolPteInUse(v15) )
      KeBugCheckEx(0x1Au, (PVOID)0x5304, (PVOID)((__int64)((v2 << 25) - ((_QWORD)PteBase << 25)) >> 16), v16, 0i64);
    v17 = *(char **)(a1 + 16);
    *(_QWORD *)(a1 + 24) += 512i64;
    *(_QWORD *)(a1 + 16) = *(_QWORD *)v17;
    LODWORD(BitsMustBeChanged) = 1;
    v18 = (v17 - (char *)MmGetPfnDb()) / 48;
    MiUpdateLargePageBitMap((UINT64)&Irp, v18, 0x200ui64, 1ui64, BitsMustBeChanged);
    LODWORD(v19) = MiMakeValidPte(0i64, v18, (*(unsigned __int16 *)(a1 + 78) >> 3) & 0x1F | 0xA4000000);
    v20 = v19;
    if( v13 < MmGetPml4eBase() || v13 > MmGetPml4eLimit() )
    {
      LOBYTE(v21) = MiPteInShadowRange((UINT64)v13);
      if( v21 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v20 & 1) != 0 )
        v20 |= 0x8000000000000000ui64;
      v13->u.Long = v20;
    }
    else
    {
      MiWriteTopLevelPxe((UINT64)v13, v19);
    }
    LODWORD(v22) = MiGetContainingPageTable((UINT64)v13);
    MiLockAndIncrementShareCount(v22);
    MiInitializeLargeNonPagedPoolLeafFrames((_MMPTE *)v2, v18);
  }
  else
  {
    MiFlushTbAsNeeded((_MMPTE *)a2, ((__int64)(v3 - a2) >> 3) + 1, *(_KTBFLUSH_TYPE *)(a1 + 44));
    v5 = *(_QWORD *)(a1 + 32);
    LOBYTE(CurrentThread) = 0;
    for( i = MmGetPteBase() + 0x800000000i64; v2 <= v3; v2 += 8i64 )
    {
      v8.u.Long = *(_QWORD *)v2;
      MiPteInShadowRange(v2);
      CurrentThread = v8.u.Long & 0x3E0;
      if( (v8.u.Long & 0xC01) == 0i64 && CurrentThread == 0 )
      {
        if( v5 )
          v9 = (__int64)(v5 - (_QWORD)i) >> 3;
        else
          v9 = 0xFFFFFFFFFi64;
        CurrentThread = MiSwizzleInvalidPte(v9 << 28);
        v10 = CurrentThread | 0x3E0;
        if( v11 )
        {
          CurrentThread = (__int64)KeGetCurrentThread();
          if( (*(_DWORD *)(*(_QWORD *)(CurrentThread + 184) + 2172i64) & 0x1000) != 0 && (v10 & 1) != 0 )
            v10 |= 0x8000000000000000ui64;
        }
        *(_QWORD *)v2 = v10;
        v5 = v2;
      }
      else if( (v8.u.Long & 1) == 0 )
      {
        LOBYTE(CurrentThread) = CurrentThread == 992;
        if( (((v8.u.Long & 0xC00) == 0i64) & (unsigned __int8)CurrentThread) != 0 )
          KeBugCheckEx(0x1Au, (PVOID)0x5308, (PVOID)v2, (PVOID)v8.u.Long, 0i64);
      }
    }
    *(_QWORD *)(a1 + 32) = v5;
  }
  return CurrentThread;
}

Referenced by: