PfpFlushBuffers

INT64 __fastcall PfpFlushBuffers(){
  _MM_PAGE_ACCESS_INFO_HEADER *v0; 
  UINT8 *v1; 
  UINT8 *v2; 
  INT64 result; 
  _MM_PAGE_ACCESS_INFO_HEADER *v4; 
  _MM_PAGE_ACCESS_INFO_HEADER *Next; 
  _MM_PAGE_ACCESS_INFO_HEADER *v6; 
  _MM_PAGE_ACCESS_INFO_HEADER *v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  INT64 Process; 
  INT64 FirstFileEntry; 
  __int64 EmptyTime; 
  unsigned __int64 EmptyTime_high; 
  int v14; 
  unsigned __int64 *PageFrameEntry; 
  unsigned __int64 v16; 
  __int64 v17; 
  unsigned __int64 *v18; 
  unsigned __int64 v19; 
  struct _SLIST_ENTRY *v20; 
  INT64 a5; 
  unsigned int v22; 
  _BYTE a3[16]; 
  INT64 v24[2]; 
  INT64 v25[2]; 
  INT64 Src; 
  int v27; 
  __int64 v28; 
  int v29; 
  *(_OWORD *)a3 = 0i64;
  *(_DWORD *)&a3[8] = 1;
  v0 = 0i64;
  *(_OWORD *)v25 = 0i64;
  v1 = 0i64;
  v2 = 0i64;
  *(_OWORD *)v24 = 0i64;
  result = PfpFlushEventBuffers();
  v22 = result;
  if( (int)result < 0 )
    goto LABEL_26;
  result = (INT64)RtlpInterlockedFlushSList((PSLIST_HEADER)&word_140CEBEC0);
  if( !result )
  {
LABEL_16:
    v14 = v22;
    goto LABEL_17;
  }
  do
  {
    v4 = (_MM_PAGE_ACCESS_INFO_HEADER *)result;
    Next = v0;
    result = *(_QWORD *)result;
    v4->Link.Next = &v0->Link;
    v0 = v4;
  }
  while( result );
  while( 1 )
  {
    v6 = v0;
    v28 = 0i64;
    v7 = v0;
    v0 = Next;
    v8 = KUSER_SHARED_DATA.TickCountMultiplier * HIDWORD(v6->EmptyTime);
    v9 = (KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)(unsigned int)v6->EmptyTime) >> 24;
    HIDWORD(v28) = dword_140C5001C
                 + ((((KUSER_SHARED_DATA.TickCountMultiplier * HIDWORD(v6->CreateTime)) << 8)
                   + ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)(unsigned int)v6->CreateTime) >> 24)) >> 10);
    v27 = HIDWORD(v28);
    v29 = dword_140C5001C + (((v8 << 8) + v9) >> 10);
    Src = 163851i64;
    PfpCopyEvent(&Src);
    if( v6->Type > MmCcReadAheadType
      || (v24[1] = v6->EmptySequenceNumber, v24[0] = 94215i64, PfpCopyEvent(v24), v6->Type > MmCcReadAheadType) )
    {
      PageFrameEntry = v6->PageFrameEntry;
      if( PageFrameEntry <= v6->FileEntry )
      {
        while( 1 )
        {
          v16 = *PageFrameEntry;
          v22 = 0;
          v17 = PfTAcquireLogEntry((__int64)&qword_140C4F918, &v22, 1);
          if( !v17 )
            break;
          v18 = (unsigned __int64 *)(16i64 * v22 + ((v17 + 31) & 0xFFFFFFFFFFFFFFF8ui64));
          v19 = *v18 & 0xFFFFFFFFFFFC6007ui64;
          v18[1] = v16;
          *v18 = v19 | 0x6007;
          ++PageFrameEntry;
          v22 = 0;
          if( PageFrameEntry > v6->FileEntry )
            goto LABEL_13;
        }
        v22 = -1073741670;
        v6->PageEntry = (_MM_PAGE_ACCESS_INFO *)PageFrameEntry;
      }
      goto LABEL_12;
    }
    Process = (INT64)v6->Process;
    FirstFileEntry = (INT64)v6->FirstFileEntry;
    if( Process == 1 )
    {
      Process = v6->SessionId + 1;
    }
    else if( Process && !PfpIsProcessInfoPresent((__int64)v6->Process) )
    {
      goto LABEL_14;
    }
    v2 = (UINT8 *)&v6[1];
    v1 = (UINT8 *)&v6[1];
    if( (_MM_PAGE_ACCESS_INFO *)&v6[1] < v6->PageEntry )
      break;
LABEL_12:
    if( (v22 & 0x80000000) != 0 )
    {
      v14 = v22;
      goto LABEL_28;
    }
LABEL_13:
    EmptyTime = (unsigned int)v6->EmptyTime;
    EmptyTime_high = HIDWORD(v6->EmptyTime);
    v25[0] = 147463i64;
    v25[1] = dword_140C5001C
           + (unsigned int)((((KUSER_SHARED_DATA.TickCountMultiplier * EmptyTime_high) << 8)
                           + (((unsigned __int64)KUSER_SHARED_DATA.TickCountMultiplier * EmptyTime) >> 24)) >> 10);
    PfpCopyEvent(v25);
LABEL_14:
    MmFreeAccessPfnBuffer(v7, 0i64);
    if( !Next )
      goto LABEL_16;
    Next = (_MM_PAGE_ACCESS_INFO_HEADER *)Next->Link.Next;
  }
  while( 1 )
  {
    LODWORD(a5) = 0;
    if( !PfpLogPageAccess(Process, v1, a3, FirstFileEntry, a5) )
      break;
    v1 += 8;
    if( (_MM_PAGE_ACCESS_INFO *)v1 >= v6->PageEntry )
      goto LABEL_12;
  }
  v14 = -1073741432;
LABEL_28:
  if( v6->Type <= MmCcReadAheadType )
  {
    memmove(v2, v1, (v6->PageEntry - (_MM_PAGE_ACCESS_INFO *)v1) & 0xFFFFFFFFFFFFFFF8ui64);
    v6->PageEntry = (_MM_PAGE_ACCESS_INFO *)((char *)v6->PageEntry - 8 * ((v1 - v2) >> 3));
  }
  PfpReturnAccessBuffer((PSLIST_ENTRY)v6);
LABEL_17:
  if( v14 >= 0 )
  {
    LOBYTE(result) = 1;
    return result;
  }
  while( v0 )
  {
    v20 = (struct _SLIST_ENTRY *)v0;
    v0 = (_MM_PAGE_ACCESS_INFO_HEADER *)v0->Link.Next;
    PfpReturnAccessBuffer(v20);
  }
LABEL_26:
  LOBYTE(result) = 0;
  return result;
}

Referenced by: