MiRemoveSystemImagePage

INT64 __fastcall MiRemoveSystemImagePage(INT64 a1, INT64 a2, INT64 a3){
  unsigned __int64 v4; 
  volatile signed __int32 *v5; 
  INT64 result; 
  UINT64 LogAccess; 
  UINT64 SpinCount; 
  LODWORD(LogAccess) = 0;
  *(_BYTE *)(a3 + 35) |= 8u;
  _InterlockedAnd64((volatile signed __int64 *)(a3 + 24), 0x7FFFFFFFFFFFFFFFui64);
  v4 = ((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  if( PsNtosImageBase
    && (v4 < PsNtosImageEnd && v4 >= PsNtosImageBase || v4 < PsHalImageEnd && v4 >= (unsigned __int64)PsHalImageBase) )
  {
    v5 = (volatile signed __int32 *)&xmmword_140C4CA88 + 2;
  }
  else
  {
    v5 = (volatile signed __int32 *)&xmmword_140C4CA88 + 3;
  }
  _InterlockedDecrement(v5);
  result = MiTerminateWsle((PVOID)a1, (_MMSUPPORT_INSTANCE *)v4, 2ui64, (UINT64)&LogAccess);
  LODWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)(a3 + 24), 0x3Fui64) )
  {
    do
    {
      KeYieldProcessorEx(&SpinCount);
      result = *(_QWORD *)(a3 + 24);
    }
    while( result < 0 );
  }
  return result;
}

Referenced by: