MiFreeSlabEntries

INT64 __fastcall MiFreeSlabEntries(INT64 rcx0, INT64 a2, INT64 a3){
  INT64 v4; 
  unsigned __int64 v6; 
  UINT64 *v7; 
  KIRQL v8; 
  __int64 v9; 
  unsigned __int64 v10; 
  _QWORD *v11; 
  _QWORD *v12; 
  int v13; 
  UINT64 v14; 
  _QWORD *v15; 
  UINT64 *v16; 
  _MMPFN *v17; 
  volatile LONG *v18; 
  _MMPFN *v19; 
  __int64 v20; 
  unsigned __int8 CurrentIrql; 
  unsigned __int64 v22; 
  int v23; 
  int v24; 
  unsigned __int64 v25; 
  _MMPFN *PfnDb; 
  _QWORD *v27; 
  unsigned __int64 v28; 
  volatile signed __int32 *v29; 
  unsigned __int64 v30; 
  UINT64 SpinCount; 
  unsigned __int64 a1; 
  v4 = rcx0;
  if( (*(_DWORD *)(a2 + 56) & 1) == 0 )
    return 0i64;
  v6 = 0i64;
  if( !(_DWORD)a3 && KiQueryUnbiasedInterruptTime(1u) - *(_QWORD *)(a2 + 104) < 0x2FAF080 )
    return 0i64;
  a1 = 0i64;
  if( !*(_QWORD *)(a2 + 64) )
    goto LABEL_6;
  v17 = 0i64;
  v18 = (volatile LONG *)(a2 + 16);
  v19 = 0i64;
  v20 = 0i64;
  do
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    ExAcquireSpinLockSharedAtDpcLevel(v18);
    v22 = *(_QWORD *)a2;
    if( (*(_BYTE *)(a2 + 8) & 1) != 0 )
    {
      if( v22 )
        v22 ^= a2;
      else
        v22 = 0i64;
    }
    v23 = *(_BYTE *)(a2 + 8) & 1;
    while( v22 )
    {
      v24 = MiCompareSlabEntry(&a1, v22);
      if( !v24 )
        goto LABEL_37;
      if( v24 >= 0 )
      {
        v25 = *(_QWORD *)(v22 + 8);
      }
      else
      {
        v25 = *(_QWORD *)v22;
        v6 = v22;
      }
      if( v23 && v25 )
        v22 ^= v25;
      else
        v22 = v25;
    }
    v22 = v6;
LABEL_37:
    v6 = 0i64;
    while( v22 )
    {
      v20 = *(unsigned int *)(v22 + 136);
      if( *(_DWORD *)(v22 + 136)
        && v20 + (unsigned __int64)*(unsigned int *)(v22 + 132) >= 0x200
        && (*(_DWORD *)(v22 + 140) & 1) == 0 )
      {
        PfnDb = MmGetPfnDb();
        v17 = (_MMPFN *)((char *)PfnDb + 48 * *(_QWORD *)(v22 + 24));
        v19 = (_MMPFN *)((char *)PfnDb + 48 * *(_QWORD *)(v22 + 32));
        goto LABEL_50;
      }
      v27 = *(_QWORD **)(v22 + 8);
      v28 = v22;
      if( v27 )
      {
        do
        {
          v22 = (unsigned __int64)v27;
          v27 = (_QWORD *)*v27;
        }
        while( v27 );
      }
      else
      {
        while( 1 )
        {
          v22 = *(_QWORD *)(v22 + 16) & 0xFFFFFFFFFFFFFFFCui64;
          if( !v22 || *(_QWORD *)v22 == v28 )
            break;
          v28 = v22;
        }
      }
    }
    PfnDb = MmGetPfnDb();
LABEL_50:
    ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)(a2 + 16));
    if( !v22 )
      break;
    if( !v20 )
      goto LABEL_68;
    v29 = (volatile signed __int32 *)((char *)v17 + 24);
    while( v17 <= v19 )
    {
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64(v29, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( *(__int64 *)v29 < 0 );
      }
      v30 = ((char *)v29 + 10 - ((char *)MmGetPfnDb() + 34)) / 48;
      if( v30 > 0xFFFFFFFFFi64
        || (*((_QWORD *)MmGetPfnDb() + 6 * v30 + 5) & 0x4000000000000i64) == 0
        || !MiIsPfnFromSlabAllocation((INT64)v17) )
      {
LABEL_65:
        v20 = 0i64;
        goto LABEL_66;
      }
      if( (*((_BYTE *)v29 + 10) & 7) != 2 || *((_WORD *)v29 + 4) || *(_QWORD *)v17 >= 0 )
      {
        if( !MiIsFreeSlabPage((INT64)v17) )
          goto LABEL_65;
      }
      else
      {
        MiUnlinkPageFromList(v17, 0i64);
        MiDiscardTransitionPteEx((UINT64)v17, 0i64);
        --v20;
      }
LABEL_66:
      _InterlockedAnd64((volatile signed __int64 *)v29, 0x7FFFFFFFFFFFFFFFui64);
      v17 = (_MMPFN *)((char *)v17 + 48);
      v29 += 12;
      if( !v20 )
        break;
    }
    PfnDb = MmGetPfnDb();
LABEL_68:
    a1 = ((__int64)((unsigned __int128)((v19 - PfnDb) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64) >> 3)
       + ((unsigned __int64)((unsigned __int128)((v19 - PfnDb) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64) >> 63)
       + 1;
    __writecr8(CurrentIrql);
    v18 = (volatile LONG *)(a2 + 16);
    CurrentIrql = 17;
  }
  while( *(_QWORD *)(a2 + 64) );
  if( CurrentIrql != 17 )
    __writecr8(CurrentIrql);
  v4 = rcx0;
LABEL_6:
  v7 = 0i64;
  v8 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)(a2 + 16));
  *(_DWORD *)(a2 + 56) &= ~1u;
  v9 = *(_QWORD *)(a2 + 8);
  v10 = v8;
  if( (v9 & 1) != 0 )
  {
    if( v9 != 1 )
    {
      v11 = (_QWORD *)(v9 ^ (a2 | 1));
      goto LABEL_13;
    }
  }
  else
  {
    v11 = *(_QWORD **)(a2 + 8);
LABEL_13:
    while( v11 )
    {
      v12 = (_QWORD *)v11[1];
      v14 = (UINT64)v11;
      v15 = v11;
      if( v12 )
      {
        do
        {
          v11 = v12;
          v12 = (_QWORD *)*v12;
        }
        while( v12 );
      }
      else
      {
        while( 1 )
        {
          v11 = (_QWORD *)(v11[2] & 0xFFFFFFFFFFFFFFFCui64);
          if( !v11 || (_QWORD *)*v11 == v15 )
            break;
          v15 = v11;
        }
      }
      if( (*(_DWORD *)(v14 + 140) & 1) == 0 )
      {
        v13 = *(_DWORD *)(v14 + 132);
        if( v13 == 512 )
        {
          MiRemoveSlabEntry(v4, (UINT64 *)a2, v14);
          *(_QWORD *)v14 = v7;
          v7 = (UINT64 *)v14;
        }
        else if( (unsigned int)(v13 + *(_DWORD *)(v14 + 136)) >= 0x200 )
        {
          *(_DWORD *)(a2 + 56) |= 1u;
        }
      }
    }
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a2 + 16));
  __writecr8(v10);
  while( 1 )
  {
    v16 = v7;
    if( !v7 )
      break;
    v7 = (UINT64 *)*v7;
    MiFreeSlabEntry(a2, v16);
  }
  return 0i64;
}

Referenced by: