MiReturnSystemCharges

UINT64 __fastcall MiReturnSystemCharges(INT64 a1, UINT64 a2, INT64 a3){
  unsigned __int64 v3; 
  unsigned __int64 v4; 
  UINT64 result; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v7; 
  bool v8; 
  __int64 v9; 
  v3 = a2;
  switch( (_DWORD)a3 )
  {
    case 1:
      goto LABEL_15;
    case 2:
      goto LABEL_6;
    case 0xB:
LABEL_15:
      v9 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64);
      _InterlockedExchangeAdd64((volatile signed __int64 *)(v9 + 40), -(__int64)v3);
      _InterlockedExchangeAdd64((volatile signed __int64 *)(v9 + 48), -(__int64)v3);
      goto LABEL_6;
  }
  v4 = -(__int64)a2;
  if( (_DWORD)a3 == 4 )
    _InterlockedExchangeAdd64(&qword_140C4ED18, v4);
  else
    _InterlockedExchangeAdd64(&qword_140C4ED00, v4);
LABEL_6:
  result = (UINT64)&MiSystemPartition;
  if( (ULONG_PTR *)a1 == &MiSystemPartition )
  {
    CurrentPrcb = KeGetCurrentPrcb();
    v7 = *((int *)CurrentPrcb + 8391);
    if( (_DWORD)v7 != -1 )
    {
      for( ; v3 + v7 <= 0x100; result = v3 + (int)result )
      {
        if( v3 >= 0x80000 )
          break;
        result = (unsigned int)_InterlockedCompareExchange((volatile signed __int32 *)CurrentPrcb + 8391, v7 + v3, v7);
        v8 = (_DWORD)v7 == (_DWORD)result;
        v7 = (int)result;
        if( v8 )
          return result;
        if( (_DWORD)result == -1 )
          break;
      }
      if( (int)v7 > 192 && (_DWORD)v7 != -1 )
      {
        result = (unsigned int)_InterlockedCompareExchange((volatile signed __int32 *)CurrentPrcb + 8391, 192, v7);
        if( (_DWORD)v7 == (_DWORD)result )
        {
          result = (unsigned int)(v7 - 192);
          v3 += (int)result;
        }
      }
    }
  }
  if( v3 )
    _InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 7168), v3);
  return result;
}

Referenced by: