MiSetVaAgeList

INT64 __fastcall MiSetVaAgeList(INT64 a1, UINT64 a2, UINT8 *r8, UINT8 a4){
  _MMPTE *PteBase; 
  char v8; 
  volatile signed __int64 *v9; 
  _MMPTE *PteLimit; 
  char v11; 
  int v12; 
  unsigned __int64 *v13; 
  struct _KPRCB *CurrentPrcb; 
  KSPIN_LOCK_QUEUE *v15; 
  _MMPTE *PdeBase; 
  _BYTE *v17; 
  int v18; 
  unsigned __int8 v19; 
  UINT64 v20; 
  __int64 *v21; 
  __int64 v22; 
  unsigned __int8 v23; 
  UINT8 v24; 
  signed __int64 v25; 
  signed __int64 v26; 
  UINT64 v27; 
  unsigned __int64 *v28; 
  unsigned __int64 v29; 
  UINT8 v30; 
  bool v31; 
  _KSPIN_LOCK_QUEUE *volatile Next; 
  UINT64 v33; 
  INT64 v34; 
  unsigned __int64 *v35; 
  char v37; 
  int v38; 
  volatile unsigned __int64 v39; 
  int v40; 
  int v42; 
  int v43; 
  volatile signed __int64 *v44; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  UINT64 v46; 
  UINT64 v47; 
  UINT64 v48; 
  _OWORD a3[2]; 
  v42 = (int)r8;
  *(_QWORD *)&LockHandle.OldIrql = 0i64;
  PteBase = MmGetPteBase();
  v8 = 0;
  v9 = (volatile signed __int64 *)((char *)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64));
  v43 = 0;
  v44 = v9;
  PteLimit = MmGetPteLimit();
  if( a2 < (unsigned __int64)PteBase || a2 > (unsigned __int64)PteLimit )
  {
    v11 = *(_BYTE *)(a1 + 184);
    v12 = 1;
    v40 = 1;
  }
  else
  {
    v11 = *(_BYTE *)(a1 + 184);
    v12 = 0;
    v40 = 0;
    if( (v11 & 7) != 0 )
      v43 = 1;
  }
  if( (v11 & 7) == 2 )
    v13 = &qword_140C4F500;
  else
    v13 = (unsigned __int64 *)(a1 + 256);
  LockHandle.LockQueue.Lock = v13;
  LockHandle.LockQueue.Next = 0i64;
  CurrentPrcb = KeGetCurrentPrcb();
  if( *((_QWORD *)CurrentPrcb + 4247) && *((_BYTE *)CurrentPrcb + 32) <= 1u && *((_BYTE *)CurrentPrcb + 32) == 1 )
    v9 = (volatile signed __int64 *)((char *)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64));
  v15 = (KSPIN_LOCK_QUEUE *)_InterlockedExchange64((volatile __int64 *)v13, (__int64)&LockHandle);
  if( v15 )
  {
    KxWaitForLockOwnerShip(&LockHandle.LockQueue, v15);
    LODWORD(r8) = v42;
    v9 = v44;
  }
  if( a4 == 8
    && *(_QWORD *)(a1 + 112) < *(_QWORD *)(*(_QWORD *)(a1 + 16) + 32i64) + 6i64 + (unsigned __int64)(unsigned int)r8 )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    return 0i64;
  }
  PdeBase = MmGetPdeBase();
  if( (_DWORD)r8 )
  {
    do
    {
      if( v12 )
      {
        v17 = 0i64;
        v8 = HIBYTE(*v9) & 0xF | (16 * (((unsigned __int64)*v9 >> 60) & 7));
        v18 = 0;
        v19 = HIBYTE(*v9) & 0xF;
        if( v19 == 8 )
          v18 = 1;
        v43 = v18;
      }
      else
      {
        v39 = *v9;
        MiPteInShadowRange((UINT64)v9);
        v18 = v43;
        v17 = (char *)MmGetPfnDb() + 48 * ((v39 >> 12) & 0xFFFFFFFFFi64);
        v19 = (*v17 >> 1) & 7;
      }
      if( v19 == 8 )
        --*(_QWORD *)(*(_QWORD *)(a1 + 16) + 32i64);
      if( !v18 )
      {
        if( a2 < (unsigned __int64)MmGetPteBase() || a2 > (unsigned __int64)MmGetPteLimit() )
        {
          v20 = *(_QWORD *)((char *)MmGetPdeBase() + ((a2 >> 18) & 0x3FFFFFF8));
          v46 = v20;
          MiPteInShadowRange((UINT64)&v46);
          v21 = (__int64 *)((char *)MmGetPfnDb() + 48 * ((v20 >> 12) & 0xFFFFFFFFFi64));
          v22 = *v21;
          v23 = ((unsigned __int64)*v21 >> 14) & 7;
          if( (((unsigned __int64)*v21 >> 4) & 0x3FF) != 0 )
          {
            if( v19 == v23 )
            {
              *v21 = v22 ^ ((unsigned __int16)v22 ^ (unsigned __int16)(16 * ((((unsigned __int64)*v21 >> 4) & 0x3FF) - 1))) & 0x3FF0;
            }
            else if( v19 > v23 )
            {
              *v21 = v22 ^ ((unsigned int)v22 ^ (v19 << 14)) & 0x1C000 | 0x3FF0;
            }
          }
          v12 = v40;
        }
        --*(_QWORD *)(a1 + 8i64 * v19 + 40);
        if( v19 == 7 )
          MiVolunteerForTrimFirst(a1, -1i64);
      }
      v24 = a4;
      if( (unsigned __int8)(a4 - 1) <= 5u
        && (MI_READ_PTE_LOCK_FREE((INT64)v44) & 0x20) != 0
        && (a2 > 0x7FFFFFFEFFFFi64 || (*(_BYTE *)(a1 + 184) & 7) != 0 || !*(_QWORD *)(a1 + 624)) )
      {
        v24 = 0;
      }
      if( v17 )
      {
        *(_QWORD *)v17 ^= ((unsigned __int8)*(_QWORD *)v17 ^ (unsigned __int8)(2 * v24)) & 0xE;
      }
      else
      {
        v8 ^= (v24 ^ v8) & 0xF;
        v25 = *v44;
        do
        {
          v26 = v25;
          v25 = _InterlockedCompareExchange64(
                  v44,
                  ((unsigned __int64)(v8 & 0x7F) << 56) | v25 & 0x80FFFFFFFFFFFFFFui64,
                  v25);
        }
        while( v26 != v25 );
      }
      if( v24 >= 8u )
      {
        if( v24 == 8 )
          ++*(_QWORD *)(*(_QWORD *)(a1 + 16) + 32i64);
      }
      else if( v12 || (*(_BYTE *)(a1 + 184) & 7) == 0 )
      {
        if( a2 < (unsigned __int64)MmGetPteBase() || a2 > (unsigned __int64)MmGetPteLimit() )
        {
          v27 = *(_QWORD *)((char *)MmGetPdeBase() + ((a2 >> 18) & 0x3FFFFFF8));
          v47 = v27;
          MiPteInShadowRange((UINT64)&v47);
          v28 = (unsigned __int64 *)((char *)MmGetPfnDb() + 48 * ((v27 >> 12) & 0xFFFFFFFFFi64));
          v29 = *v28;
          v30 = (*v28 >> 14) & 7;
          if( ((*v28 >> 4) & 0x3FF) != 0 )
          {
            if( v24 == v30 )
            {
              *v28 = v29 ^ ((unsigned __int16)v29 ^ (unsigned __int16)(16 * (((*v28 >> 4) & 0x3FF) + 1))) & 0x3FF0;
            }
            else if( v24 > v30 )
            {
              *v28 = v29 & 0xFFFFFFFFFFFE001Fui64 | ((unsigned __int64)(v24 & 7) << 14) | 0x10;
            }
          }
          v12 = v40;
        }
        ++*(_QWORD *)(a1 + 8i64 * v24 + 40);
        if( v24 == 7 )
          MiVolunteerForTrimFirst(a1, 1i64);
      }
      v31 = v42-- == 1;
      v9 = v44;
    }
    while( !v31 );
    PdeBase = MmGetPdeBase();
  }
  _m_prefetchw(&LockHandle);
  Next = LockHandle.LockQueue.Next;
  if( !LockHandle.LockQueue.Next )
  {
    if( (struct _KLOCK_QUEUE_HANDLE *)_InterlockedCompareExchange64(
                                         (volatile signed __int64 *)LockHandle.LockQueue.Lock,
                                         0i64,
                                         (signed __int64)&LockHandle) == &LockHandle )
      goto LABEL_44;
    Next = KxWaitForLockChainValid(&LockHandle.LockQueue);
  }
  LockHandle.LockQueue.Next = 0i64;
  _InterlockedXor64((volatile signed __int64 *)&Next->Lock, 1ui64);
LABEL_44:
  if( v12 )
  {
    v48 = *(_QWORD *)((char *)PdeBase + ((a2 >> 18) & 0x3FFFFFF8));
    v33 = v48;
    MiPteInShadowRange((UINT64)&v48);
    v35 = (unsigned __int64 *)((char *)MmGetPfnDb() + 48 * ((v33 >> 12) & 0xFFFFFFFFFi64));
    if( ((*(_DWORD *)v35 >> 4) & 0x3FF) == 0 )
    {
      MiCountWslesInPageTable(v34, a2, a3);
      v37 = 8;
      while( 1 )
      {
        v38 = *((_DWORD *)a3 + (unsigned __int8)--v37);
        if( v38 )
          break;
        if( !v37 )
          return 1i64;
      }
      *v35 = *v35 & 0xFFFFFFFFFFFE000Fui64 | (16 * (v38 & 0x3FF | ((unsigned __int64)(v37 & 7) << 10)));
    }
  }
  return 1i64;
}

Referenced by: