MiChargeSegmentCommit

__int64 __fastcall MiChargeSegmentCommit(__int64 *a1, __int64 *a2, __int64 a3){
  _ETHREAD *CurrentThread; 
  _MI_PARTITION *ControlAreaPartition; 
  __int64 v7; 
  __int64 v8; 
  UNICODE_STRING *v9; 
  __int64 v10; 
  UNICODE_STRING *v11; 
  __int64 v12; 
  volatile INT64 *v13; 
  __int64 v14; 
  UINT64 v15; 
  __int64 *v16; 
  WCHAR *v17; 
  _MMPTE *Pml4eBase; 
  _MMPTE *PxeUserLimit; 
  INT64 PteShadow; 
  UINT64 v21; 
  __int64 v22; 
  __int64 *v24; 
  __int64 DemandZeroPte; 
  __int64 *v26; 
  INT64 updated; 
  unsigned int *v28; 
  _QWORD *v29; 
  UINT64 a3a; 
  INT64 v32; 
  volatile INT64 *Lock; 
  _ETHREAD *v34; 
  __int64 *FreePhysicalPages; 
  int SubsectionCrossPartitionReferences; 
  volatile INT64 *a1a; 
  __int64 v38; 
  FreePhysicalPages = a1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v34 = CurrentThread;
  v32 = *a1;
  v38 = *(_QWORD *)*a1;
  ControlAreaPartition = MiGetControlAreaPartition((_CONTROL_AREA *)*a1);
  v8 = *(unsigned int *)(v7 + 44);
  a1a = (volatile INT64 *)ControlAreaPartition;
  v9 = (UNICODE_STRING *)a2;
  v29 = (_QWORD *)(v7 + 8);
  v10 = *(_QWORD *)(v7 + 8);
  --*((_WORD *)CurrentThread + 243);
  v28 = (unsigned int *)(v7 + 44);
  v11 = (UNICODE_STRING *)(v10 + 8 * v8);
  v13 = (volatile INT64 *)(v12 + 40);
  Lock = (volatile INT64 *)(v12 + 40);
  ExAcquirePushLockExclusiveEx(v12 + 40, 0i64);
  v14 = 0i64;
  v15 = 0i64;
  SubsectionCrossPartitionReferences = MiGetSubsectionCrossPartitionReferences((INT64)FreePhysicalPages);
  Pml4eBase = MmGetPml4eBase();
  PxeUserLimit = MmGetPxeUserLimit();
  while( 1 )
  {
    PteShadow = *(_QWORD *)&v9->Length;
    if( v9 >= (UNICODE_STRING *)Pml4eBase && v9 <= (UNICODE_STRING *)PxeUserLimit )
    {
      PteShadow = MiReadPteShadow(v9, *(UNICODE_STRING **)&v9->Length, (UINT8)v16, v17);
      v16 = FreePhysicalPages;
    }
    v21 = v15 + 1;
    if( PteShadow )
      v21 = v15;
    v17 = (WCHAR *)((char *)v17 + 1);
    v9 = (UNICODE_STRING *)((char *)v9 + 8);
    v15 = v21;
    if( v17 == (WCHAR *)a3 )
      break;
    if( v9 == v11 )
    {
      v16 = (__int64 *)v16[2];
      FreePhysicalPages = v16;
      v9 = (UNICODE_STRING *)v16[1];
      v11 = (UNICODE_STRING *)((char *)v9 + 8 * *((unsigned int *)v16 + 11));
    }
  }
  a3a = v21;
  if( !v21 )
  {
    if( (_InterlockedExchangeAdd64(v13, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v13);
    KeAbPostRelease((PVOID)v13);
    v22 = (__int64)CurrentThread;
LABEL_14:
    KiLeaveGuardedRegionUnsafe(v22);
    return 1i64;
  }
  if( (unsigned int)MiChargeCommit((_MI_PARTITION *)a1a, v21, 0i64) )
  {
    if( !SubsectionCrossPartitionReferences || MiGetSubsectionCharges((UINT8)FreePhysicalPages) >= 0 )
    {
      v24 = a1;
      DemandZeroPte = MiMakeDemandZeroPte((*(_BYTE *)(v38 + 14) >> 1) & 0x1F);
      v26 = (__int64 *)(*v29 + 8i64 * *v28);
      while( 1 )
      {
        if( !MI_READ_PTE_LOCK_FREE((INT64)a2) )
          *a2 = DemandZeroPte;
        ++v14;
        ++a2;
        if( v14 == a3 )
          break;
        if( a2 == v26 )
        {
          v24 = (__int64 *)v24[2];
          a2 = (__int64 *)v24[1];
          v26 = &a2[*((unsigned int *)v24 + 11)];
        }
      }
      MiUpdateProcessSharedCommit(v32);
      updated = MiUpdateControlAreaCommitCount(v32, a3a);
      if( SubsectionCrossPartitionReferences && !updated )
        MiReturnCrossPartitionSectionCharges(a1a, 0i64, a3a);
      if( (_InterlockedExchangeAdd64(Lock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(Lock);
      KeAbPostRelease((PVOID)Lock);
      v22 = (__int64)v34;
      goto LABEL_14;
    }
    MiReturnCommit((_MI_PARTITION *)a1a, v15);
    if( (_InterlockedExchangeAdd64(v13, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      goto LABEL_28;
  }
  else if( (_InterlockedExchangeAdd64(v13, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
  {
LABEL_28:
    ExfTryToWakePushLock(v13);
  }
  KeAbPostRelease((PVOID)v13);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return 0i64;
}

Referenced by: