MiProcessTransitionHeatBatch

INT64 __fastcall MiProcessTransitionHeatBatch(INT64 a1){
  _ETHREAD *CurrentThread; 
  _ETHREAD *v3; 
  __int64 v4; 
  __int64 v5; 
  char v6; 
  int SessionId; 
  bool v8; 
  _QWORD *i; 
  unsigned __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  unsigned __int64 v13; 
  _QWORD *v14; 
  unsigned int v16; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 243);
  v16 = 0;
  v3 = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)v3 + 243);
  if( ++*((_BYTE *)v3 + 794) != 1 )
  {
    v4 = 0i64;
    goto LABEL_3;
  }
  LOBYTE(v5) = *((_BYTE *)v3 + 792);
  if( !(_BYTE)v5 )
  {
    if( !*((_BYTE *)v3 + 870) )
    {
      v4 = 0i64;
      goto LABEL_3;
    }
    v5 = *((unsigned __int8 *)v3 + 870);
    *((_BYTE *)v3 + 870) = 0;
    LOBYTE(v5) = *((_BYTE *)v3 + 792) | v5;
  }
  v6 = v5;
  _BitScanForward((unsigned int *)&v5, (unsigned __int8)v5);
  *((_BYTE *)v3 + 792) = v6 & ~(1 << v5);
  v4 = *((_QWORD *)v3 + 100) + 96 * v5;
  if( !v4 )
  {
LABEL_3:
    _interlockedbittestandset((volatile signed __int32 *)v3 + 30, 0x10u);
    goto LABEL_14;
  }
  if( (unsigned __int64)&qword_140C50B80 >= 0xFFFF800000000000ui64
    && *((_BYTE *)&antNameB + (((unsigned __int64)&qword_140C50B80 >> 39) & 0x1FF) - 256) == 1 )
  {
    SessionId = MmGetSessionIdEx(*((_QWORD *)v3 + 23));
  }
  else
  {
    SessionId = -1;
  }
  *(_DWORD *)(v4 + 40) = SessionId;
  *(_QWORD *)(v4 + 32) = (unsigned __int64)&qword_140C50B80 & 0x7FFFFFFFFFFFFFFCi64;
LABEL_14:
  --*((_BYTE *)v3 + 794);
  KiAbThreadRemoveBoosts((ULONG_PTR)v3, (__int64)&qword_140C50B80, &v16);
  v8 = (*((_WORD *)v3 + 243))++ == 0xFFFF;
  if( v8 && *((_ETHREAD **)v3 + 19) != (_ETHREAD *)((char *)v3 + 152) )
    KiCheckForKernelApcDelivery();
  if( !_InterlockedCompareExchange64((volatile signed __int64 *)&qword_140C50B80, 17i64, 0i64)
    || ExfTryAcquirePushLockShared(&qword_140C50B80) )
  {
    if( v4 )
      *(_BYTE *)(v4 + 26) |= 1u;
    for( i = (_QWORD *)(a1 + 16); ; ++i )
    {
      if( (unsigned __int64)i >= a1 + 16 + 8 * (unsigned __int64)*(unsigned int *)(a1 + 4) )
      {
        MiNotifyPageHeat((INT64 *)a1);
        goto LABEL_34;
      }
      v10 = *i >> 12;
      v11 = (*i & 0x3FFi64) + 1;
      v12 = (*i >> 10) & 3i64;
      if( ((*i >> 10) & 3) != 0 )
      {
        do
        {
          v11 <<= 9;
          v10 >>= 9;
          LODWORD(v12) = v12 - 1;
        }
        while( (_DWORD)v12 );
      }
      v13 = v11 + v10;
      if( v10 < v11 + v10 )
        break;
LABEL_31:
      ;
    }
    v14 = (_QWORD *)((char *)MmGetPfnDb() + 48 * v10 + 40);
    while( v10 <= 0xFFFFFFFFFi64 && ((*v14 >> 50) & 1) != 0 )
    {
      ++v10;
      v14 += 6;
      if( v10 >= v13 )
        goto LABEL_31;
    }
LABEL_34:
    if( _InterlockedCompareExchange64((volatile signed __int64 *)&qword_140C50B80, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared((INT64 *)&qword_140C50B80);
    KeAbPostRelease(&qword_140C50B80);
  }
  else if( v4 )
  {
    KeAbPostReleaseEx(&qword_140C50B80, (PVOID)v4);
  }
  return KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
}

Referenced by: