MxCreateFreePfns

void __fastcall MxCreateFreePfns(__int64 a1){
  INT64 v1; 
  UINT64 v2; 
  int v3; 
  int v4; 
  __int64 v5; 
  _MMPFN *PfnDb; 
  INT64 v7; 
  __m128i *v8; 
  __int16 v9; 
  _QWORD *v10; 
  unsigned __int64 v11; 
  INT64 v12; 
  BOOL v13; 
  int v14; 
  __int64 v15; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  unsigned int v18; 
  unsigned int i; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  INT64 v25; 
  unsigned __int64 v26; 
  unsigned __int8 v27; 
  int v28; 
  unsigned int v29; 
  unsigned int v30; 
  unsigned __int8 CurrentIrql; 
  unsigned __int64 v32; 
  _MMPFN *v33; 
  __m128i *v34; 
  INT64 v35; 
  INT64 v36; 
  INT64 v37; 
  __m128i *v38; 
  __int64 v39; 
  unsigned int v40; 
  INT64 a1a[2]; 
  __int64 v42; 
  INT64 a2[2]; 
  __int128 v44; 
  __int128 v45; 
  int v46; 
  unsigned __int64 v47; 
  unsigned __int8 v48; 
  BOOL v49; 
  UINT64 SpinCount; 
  v1 = *(_QWORD *)(a1 + 24);
  v2 = *(_QWORD *)(a1 + 32);
  v3 = 0;
  *(_OWORD *)a2 = 0i64;
  v44 = 0i64;
  v45 = 0i64;
  if( !v1 )
  {
    if( !--v2 )
      return;
    v1 = 1i64;
  }
  v4 = *(_DWORD *)(a1 + 16);
  if( v4 == 2 || (v5 = 1i64, v4 == 24) )
    v5 = 0i64;
  v39 = v5;
  PfnDb = MmGetPfnDb();
  v49 = v4 != 24;
  v7 = (INT64)PfnDb + 48 * v1;
  v38 = 0i64;
  v8 = 0i64;
  if( !v2 )
    goto LABEL_48;
  do
  {
    if( v5 )
    {
      v9 = *(_WORD *)(v7 + 32);
      if( v9 == 1 )
      {
        v10 = (_QWORD *)(*(_QWORD *)(v7 + 8) | 0x8000000000000000ui64);
        v11 = ZeroPte;
        v12 = (INT64)PfnDb + 48 * (*(_QWORD *)(v7 + 40) & 0xFFFFFFFFFi64);
        v46 = v3;
        v13 = MiPteInShadowRange((UINT64)v10);
        v3 = 0;
        if( v13 && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 )
        {
          v14 = v46;
          if( (ZeroPte & 1) != 0 )
            v11 = ZeroPte | 0x8000000000000000ui64;
        }
        else
        {
          v14 = v46;
        }
        *v10 = v11;
        if( v14 )
          MiWritePteShadow();
        v15 = *(_QWORD *)(v12 + 24) ^ ((*(_QWORD *)(v12 + 24) - 1i64) ^ *(_QWORD *)(v12 + 24)) & 0x3FFFFFFFFFFFFFFFi64;
        *(_QWORD *)(v12 + 24) = v15;
        if( (v15 & 0x3FFFFFFFFFFFFFFFi64) == 1 )
        {
          MiFreeEmptyBootPageTable(v12);
          v3 = 0;
        }
        v5 = v39;
        *(_WORD *)(v7 + 32) = v3;
        *(_QWORD *)(v7 + 24) &= 0xC000000000000000ui64;
      }
      else if( v9 )
      {
        goto LABEL_46;
      }
    }
    if( (v1 & 0x1FF) != 0 || v5 || v2 < 0x200 )
    {
      *(_QWORD *)v7 = v8;
      v8 = (__m128i *)v7;
      v38 = (__m128i *)v7;
LABEL_46:
      ++v1;
      v7 += 48i64;
      --v2;
      goto LABEL_47;
    }
    MiRestrictRangeToNode(v1, v2);
    v47 = v16;
    v17 = v16;
    if( v16 < 0x200 )
    {
      *(_QWORD *)v7 = v8;
      ++v1;
      v8 = (__m128i *)v7;
      v38 = (__m128i *)v7;
      v7 += 48i64;
      --v2;
      goto LABEL_44;
    }
    v18 = ((KeFeatureBits >> 37) & 1) == 0;
    v40 = v18;
    for( i = v18; i <= 1; ++i )
    {
      v20 = MiLargePageSizes[i];
      if( v1 != (v1 & ~(v20 - 1)) || v17 < v20 )
        continue;
      v21 = v17;
      if( i == v18 )
      {
        v24 = v17;
      }
      else
      {
        v22 = MiLargePageSizes[i - 1];
        v23 = v22 - (v1 & (v22 - 1));
        if( v23 <= v17 )
          v21 = v23;
        v24 = v21;
      }
      v25 = v21 - v24 % v20;
      LODWORD(v37) = 0;
      LODWORD(v35) = MiDetermineNewPfnHeatState(0i64) == 0;
      MiInitializeAllResidentPageBasePfns((UINT16 *)&MiSystemPartition, v1, v25, i, 1, v35, v37);
      LODWORD(v36) = 0;
      MiCreateInitialLargeLeafPfns(v1, v25, i, 1, 0, v36);
      if( v25 )
      {
        v26 = v47;
        do
        {
          v27 = MiLockPageInline(v7);
          a1a[1] = v49;
          a1a[0] = v1;
          v42 = v27;
          MiInsertLargePageInNodeList((INT64)a1a);
          v26 -= v20;
          v2 -= v20;
          v1 += v20;
          v7 += 48 * v20;
          v25 -= v20;
        }
        while( v25 );
        v47 = v26;
        v18 = v40;
      }
      v17 = v47;
      if( v47 < 0x200 )
        break;
      i = v18 - 1;
    }
    v8 = v38;
LABEL_44:
    v3 = 0;
LABEL_47:
    v5 = v39;
    PfnDb = MmGetPfnDb();
  }
  while( v2 );
LABEL_48:
  v28 = MiDetermineNewPfnHeatState(0i64);
  v30 = v29 | 0x400;
  if( !v28 )
    v30 = v29;
  MiCreatePfnTemplate(v49, (INT64)a2);
  CurrentIrql = KeGetCurrentIrql();
  v48 = CurrentIrql;
  __writecr8(v32);
  if( v8 )
  {
    v33 = MmGetPfnDb();
    do
    {
      v34 = v8;
      v8 = (__m128i *)v8->m128i_i64[0];
      MiCreateInitialPfns(v34, 1i64, (__m128i *)a2);
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64(&v34[1].m128i_i32[2], 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( v34[1].m128i_i64[1] < 0 );
      }
      MiInsertPageInFreeOrZeroedList(((char *)v34 - (char *)v33) / 48, v30);
      _InterlockedAnd64(&v34[1].m128i_i64[1], 0x7FFFFFFFFFFFFFFFui64);
    }
    while( v8 );
    CurrentIrql = v48;
  }
  __writecr8(CurrentIrql);
}

Referenced by: