MiObtainSystemCacheView

MMPTE *__stdcall MiObtainSystemCacheView(_MI_PARTITION *Partition){
  _ETHREAD *CurrentThread; 
  unsigned int v3; 
  unsigned __int8 CurrentIrql; 
  WORK_QUEUE_TYPE v5; 
  PVOID v6; 
  void(__fastcall *v7)(void *, void *, _IO_WORKITEM *); 
  INT64 v8; 
  __int64 v9; 
  _QWORD *v10; 
  UINT64 v11; 
  int v12; 
  int v13; 
  unsigned int v14; 
  __int64 v15; 
  INT64 v17; 
  void(__fastcall *Routine)(void *, void *, _IO_WORKITEM *); 
  __int64 v19; 
  UINT64 v20; 
  INT64 v21; 
  INT64 *v22; 
  UINT64 v23; 
  __int64 v24; 
  UINT64 v25; 
  int v26; 
  int v27; 
  unsigned int v28; 
  unsigned int v29; 
  signed __int64 v30; 
  signed __int64 v31; 
  ULONG_PTR v32; 
  char v33; 
  _ETHREAD *v34; 
  unsigned int v35; 
  int v36; 
  bool v37; 
  __int64 v38; 
  unsigned __int64 v39; 
  int v40; 
  unsigned int v41; 
  __int64 v42; 
  ULONG_PTR v43; 
  WORK_QUEUE_TYPE v44; 
  void *v45; 
  int v46; 
  _ETHREAD *v47; 
  unsigned int v48; 
  char v49; 
  int v50; 
  __int64 v51; 
  unsigned __int64 v52; 
  int v53; 
  unsigned int v54; 
  __int64 v55; 
  _ETHREAD *v56; 
  ULONG_PTR SessionId; 
  char *v58; 
  int v59; 
  __int64 v60; 
  unsigned __int64 v61; 
  int v62; 
  unsigned int v63; 
  __int64 v64; 
  unsigned __int8 v65; 
  UINT64 v66; 
  volatile INT64 *v67; 
  _ETHREAD *v68; 
  ULONG_PTR v69; 
  ULONG_PTR v70; 
  char *v71; 
  int v72; 
  __int64 v73; 
  _ETHREAD *WorkOnBehalfThread; 
  int v75; 
  unsigned int v76; 
  unsigned __int8 v77; 
  __int64 v78; 
  WORK_QUEUE_TYPE v79; 
  void *v80; 
  int v81; 
  void *Parameter; 
  UINT64 PteLink; 
  unsigned __int8 v84; 
  int v85[8]; 
  char v86; 
  UINT64 *v87; 
  int v88; 
  unsigned int v89; 
  _ETHREAD *v90; 
  int v91; 
  int v92; 
  int v93; 
  int v94; 
  int v95; 
  int v96; 
  int v97; 
  int v98; 
  struct _IO_WORKITEM LockHandle; 
  __int64 v100; 
  INT64 result[20]; 
  __int64 v102[12]; 
  LockHandle.WorkItem.Parameter = 0i64;
  LockHandle.IoObject = 0i64;
  memset((INT64)result, 0i64);
  LockHandle.WorkItem.WorkerRoutine = 0i64;
  memset((INT64)v102, 0i64);
  *(_QWORD *)&LockHandle.ActivityId.Data2 = 20i64;
  CurrentThread = 0i64;
  *(_QWORD *)&LockHandle.Type = 0i64;
  v3 = 0;
  *(_QWORD *)&LockHandle.ActivityId.Data4[4] = 0i64;
  v100 = 0i64;
  v90 = 0i64;
  v88 = 0;
  v89 = 0;
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  LockHandle.WorkItem.List.Flink = 0i64;
  LockHandle.WorkItem.List.Blink = (_LIST_ENTRY *)&qword_140C4E0E8;
  KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)&qword_140C4E0E8, v5, v6);
  if( !*((_BYTE *)Partition + 6940) )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
    __writecr8(CurrentIrql);
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v90 = CurrentThread;
    --*((_WORD *)CurrentThread + 243);
    v43 = (ULONG_PTR)Partition + 1856;
    ExAcquirePushLockExclusiveEx((UINT64)Partition + 1856, 0i64);
    if( *((_BYTE *)Partition + 6940) )
    {
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v43, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)Partition + 232);
      v56 = (_ETHREAD *)KeGetCurrentThread();
      v94 = 0;
      if( (unsigned int)MiGetSystemRegionType((UINT64)Partition + 1856) == 1 )
        SessionId = (unsigned int)MmGetSessionIdEx(*((_QWORD *)v56 + 23));
      else
        SessionId = 0xFFFFFFFFi64;
      --*((_WORD *)v56 + 243);
      ++*((_BYTE *)v56 + 794);
      v58 = (char *)Partition + 1856;
      v86 = *((_BYTE *)v56 + 794);
      v59 = (*((char *)v56 + 792) | *((char *)v56 + 870)) ^ 0x3F;
      v37 = !_BitScanReverse((unsigned int *)&v60, v59);
      v93 = v60;
      if( v37 )
        goto LABEL_105;
      while( 1 )
      {
        v61 = *((_QWORD *)v56 + 100) + 96 * v60;
        v87 = (UINT64 *)v61;
        v59 &= ~(1 << v60);
        if( (*(_BYTE *)(v61 + 26) & 1) != 0
          && (*(_DWORD *)(v61 + 32) & 1) == 0
          && (*(_QWORD *)(v61 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (((unsigned __int64)Partition + 1856) & 0x7FFFFFFFFFFFFFFCi64)
          && *(_DWORD *)(v61 + 40) == (_DWORD)SessionId )
        {
          *(_BYTE *)(v61 + 26) &= ~1u;
          if( *(_QWORD *)(v61 + 32) )
            break;
        }
        v37 = !_BitScanReverse((unsigned int *)&v60, v59);
        v93 = v60;
        if( v37 )
          goto LABEL_105;
      }
      if( !v61 )
      {
LABEL_105:
        if( (*((_DWORD *)v56 + 30) & 0x10000) == 0 )
          KeBugCheckEx(0x162u, (ULONG_PTR)v56, (ULONG_PTR)Partition + 1856, SessionId, 0i64);
      }
      else
      {
        *(_BYTE *)(v61 + 32) |= 2u;
        if( *(__int64 *)(v61 + 32) < 0 )
        {
          KiAbEntryRemoveFromTree(v61);
          v61 = (unsigned __int64)v87;
          v58 = (char *)Partition + 1856;
        }
        v62 = *(_DWORD *)(v61 + 88) & 0x1FFFF;
        v63 = *(_DWORD *)(v61 + 88) & 0xFFFE0000;
        *(_BYTE *)(v61 + 25) &= ~1u;
        v94 = v62;
        *(_DWORD *)(v61 + 88) = v63;
        *(_QWORD *)(v61 + 32) = 0i64;
        v64 = (__int64)((unsigned __int128)((__int64)(v61 - *((_QWORD *)v56 + 100)) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64) >> 4;
        v65 = 1 << (v64 + (v64 < 0));
        if( v86 == 1 )
          *((_BYTE *)v56 + 792) |= v65;
        else
          _InterlockedOr8((volatile signed __int8 *)v56 + 870, v65);
      }
      --*((_BYTE *)v56 + 794);
      KiAbThreadRemoveBoosts((ULONG_PTR)v56, (__int64)v58, (unsigned int *)&v94);
      v37 = (*((_WORD *)v56 + 243))++ == 0xFFFF;
      if( v37 && *((_ETHREAD **)v56 + 19) != (_ETHREAD *)((char *)v56 + 152) )
        KiCheckForKernelApcDelivery();
      KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
      CurrentThread = 0i64;
      v90 = 0i64;
    }
    else
    {
      MiInitializeSystemCache(Partition);
      if( !v46 )
      {
        if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v43, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((volatile INT64 *)Partition + 232);
        v47 = (_ETHREAD *)KeGetCurrentThread();
        v92 = 0;
        if( (unsigned int)MiGetSystemRegionType((UINT64)Partition + 1856) == 1 )
          v48 = MmGetSessionIdEx(*((_QWORD *)v47 + 23));
        else
          v48 = -1;
        --*((_WORD *)v47 + 243);
        v49 = ++*((_BYTE *)v47 + 794);
        v50 = (*((char *)v47 + 792) | *((char *)v47 + 870)) ^ 0x3F;
        v37 = !_BitScanReverse((unsigned int *)&v51, v50);
        v91 = v51;
        if( v37 )
          goto LABEL_81;
        while( 1 )
        {
          v52 = *((_QWORD *)v47 + 100) + 96 * v51;
          v50 &= ~(1 << v51);
          if( (*(_BYTE *)(v52 + 26) & 1) != 0
            && (*(_DWORD *)(v52 + 32) & 1) == 0
            && (*(_QWORD *)(v52 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v43 & 0x7FFFFFFFFFFFFFFCi64)
            && *(_DWORD *)(v52 + 40) == v48 )
          {
            *(_BYTE *)(v52 + 26) &= ~1u;
            if( *(_QWORD *)(v52 + 32) )
              break;
          }
          v37 = !_BitScanReverse((unsigned int *)&v51, v50);
          v91 = v51;
          if( v37 )
            goto LABEL_81;
        }
        if( !v52 )
        {
LABEL_81:
          if( (*((_DWORD *)v47 + 30) & 0x10000) == 0 )
            KeBugCheckEx(0x162u, (ULONG_PTR)v47, v43, v48, 0i64);
        }
        else
        {
          *(_BYTE *)(v52 + 32) |= 2u;
          if( *(__int64 *)(v52 + 32) < 0 )
            KiAbEntryRemoveFromTree(v52);
          v53 = *(_DWORD *)(v52 + 88) & 0x1FFFF;
          v54 = *(_DWORD *)(v52 + 88) & 0xFFFE0000;
          *(_BYTE *)(v52 + 25) &= ~1u;
          v92 = v53;
          *(_DWORD *)(v52 + 88) = v54;
          *(_QWORD *)(v52 + 32) = 0i64;
          v55 = (__int64)(v52 - *((_QWORD *)v47 + 100)) / 96;
          if( v49 == 1 )
            *((_BYTE *)v47 + 792) |= 1 << v55;
          else
            _InterlockedOr8((volatile signed __int8 *)v47 + 870, 1 << v55);
        }
        --*((_BYTE *)v47 + 794);
        KiAbThreadRemoveBoosts((ULONG_PTR)v47, v43, (unsigned int *)&v92);
        v37 = (*((_WORD *)v47 + 243))++ == 0xFFFF;
        if( v37 && *((_ETHREAD **)v47 + 19) != (_ETHREAD *)((char *)v47 + 152) )
          KiCheckForKernelApcDelivery();
        KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
        return 0i64;
      }
    }
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    LockHandle.WorkItem.List.Flink = 0i64;
    LockHandle.WorkItem.List.Blink = (_LIST_ENTRY *)&qword_140C4E0E8;
    KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)&qword_140C4E0E8, v44, v45);
    if( CurrentThread )
      *((_BYTE *)Partition + 6940) = 1;
  }
  v7 = (void(__fastcall *)(void *, void *, _IO_WORKITEM *))((char *)MmGetPteBase()
                                                           + ((((unsigned __int64)Partition + 1784) >> 9) & 0x7FFFFFFFF8i64));
  LockHandle.Routine = v7;
  do
  {
    if( MiGetPteLink(*((_QWORD *)Partition + 223)) != ((__int64)v7 - *((_QWORD *)Partition + 225)) >> 3 )
      goto LABEL_4;
  }
  while( MiExpandSystemCache((INT16 *)Partition, (UINT64 *)&LockHandle.IoObject) );
  KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
  __writecr8(CurrentIrql);
  if( CurrentThread )
  {
    v67 = (volatile INT64 *)((char *)Partition + 1856);
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)Partition + 232, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    {
      ExfTryToWakePushLock(v67);
      v67 = (volatile INT64 *)((char *)Partition + 1856);
    }
    v68 = (_ETHREAD *)KeGetCurrentThread();
    v87 = (UINT64 *)v68;
    v96 = 0;
    if( (unsigned int)MiGetSystemRegionType((UINT64)v67) == 1 )
      v69 = (unsigned int)MmGetSessionIdEx(*((_QWORD *)v68 + 23));
    else
      v69 = 0xFFFFFFFFi64;
    --*((_WORD *)v68 + 243);
    v70 = (ULONG_PTR)v68;
    ++*((_BYTE *)v68 + 794);
    v71 = (char *)Partition + 1856;
    v86 = *((_BYTE *)v68 + 794);
    LockHandle.Context = (void *)(((unsigned __int64)Partition + 1856) & 0x7FFFFFFFFFFFFFFCi64);
    v72 = (*((char *)v68 + 792) | *((char *)v68 + 870)) ^ 0x3F;
    v37 = !_BitScanReverse((unsigned int *)&v73, v72);
    v95 = v73;
    if( v37 )
      goto LABEL_137;
    while( 1 )
    {
      LODWORD(v90) = ~(1 << v73) & v72;
      WorkOnBehalfThread = (_ETHREAD *)(*((_QWORD *)v68 + 100) + 96 * v73);
      LockHandle.WorkOnBehalfThread = WorkOnBehalfThread;
      if( (*((_BYTE *)WorkOnBehalfThread + 26) & 1) != 0
        && (*((_DWORD *)WorkOnBehalfThread + 8) & 1) == 0
        && (void *)(*((_QWORD *)WorkOnBehalfThread + 4) & 0x7FFFFFFFFFFFFFFCi64) == LockHandle.Context
        && *((_DWORD *)WorkOnBehalfThread + 10) == (_DWORD)v69 )
      {
        *((_BYTE *)WorkOnBehalfThread + 26) &= ~1u;
        if( *((_QWORD *)WorkOnBehalfThread + 4) )
          break;
      }
      v72 = (int)v90;
      v37 = !_BitScanReverse((unsigned int *)&v73, (unsigned int)v90);
      v95 = v73;
      if( v37 )
        goto LABEL_137;
    }
    if( !WorkOnBehalfThread )
    {
LABEL_137:
      if( (*((_DWORD *)v68 + 30) & 0x10000) == 0 )
        KeBugCheckEx(0x162u, (ULONG_PTR)v68, (ULONG_PTR)Partition + 1856, v69, 0i64);
    }
    else
    {
      *((_BYTE *)WorkOnBehalfThread + 32) |= 2u;
      if( *((__int64 *)WorkOnBehalfThread + 4) < 0 )
      {
        KiAbEntryRemoveFromTree((unsigned __int64)WorkOnBehalfThread);
        v70 = (ULONG_PTR)v87;
        v71 = (char *)Partition + 1856;
        WorkOnBehalfThread = LockHandle.WorkOnBehalfThread;
      }
      v75 = *((_DWORD *)WorkOnBehalfThread + 22) & 0x1FFFF;
      v76 = *((_DWORD *)WorkOnBehalfThread + 22) & 0xFFFE0000;
      *((_BYTE *)WorkOnBehalfThread + 25) &= ~1u;
      v96 = v75;
      *((_DWORD *)WorkOnBehalfThread + 22) = v76;
      *((_QWORD *)WorkOnBehalfThread + 4) = 0i64;
      v77 = 1 << ((char)((_BYTE)WorkOnBehalfThread - *(_BYTE *)(v70 + 800)) / 96);
      if( v86 == 1 )
        *(_BYTE *)(v70 + 792) |= v77;
      else
        _InterlockedOr8((volatile signed __int8 *)(v70 + 870), v77);
    }
    --*(_BYTE *)(v70 + 794);
    KiAbThreadRemoveBoosts(v70, (__int64)v71, (unsigned int *)&v96);
    v78 = (__int64)v87;
    v37 = (*((_WORD *)v87 + 243))++ == 0xFFFF;
    if( v37 && *(_QWORD *)(v78 + 152) != v78 + 152 )
      KiCheckForKernelApcDelivery();
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    v90 = 0i64;
  }
  if( LockHandle.IoObject )
    MiReturnSystemVa((UINT64)LockHandle.IoObject, (UINT64)LockHandle.IoObject + 0x200000, 8i64);
  CcUnmapInactiveViews(*((_QWORD *)Partition + 22), v66, 0i64);
  if( v81 == 1 )
  {
    Parameter = LockHandle.WorkItem.Parameter;
    v8 = (INT64)MmGetPteBase() + (((unsigned __int64)LockHandle.WorkItem.Parameter >> 9) & 0x7FFFFFFFF8i64);
    if( MiGetPteLink(*(_QWORD *)(v8 + 24)) == 2 )
    {
      PteLink = MiGetPteLink(*(_QWORD *)(v8 + 16));
      if( MiCompareTbFlushTimeStamp(PteLink, 0xFFFFFui64) )
      {
        MiInsertTbFlushEntry((INT64)&LockHandle.Type, (UINT64)Parameter, 64i64, 0i64);
        MiFlushTbList((__int64)&LockHandle.Type);
      }
    }
    *(_QWORD *)v8 = ZeroPte;
    *(_QWORD *)(v8 + 8) = ZeroPte;
    *(_QWORD *)(v8 + 16) = ZeroPte;
    return(MMPTE *)v8;
  }
  v84 = KeGetCurrentIrql();
  __writecr8(2ui64);
  LockHandle.WorkItem.List.Flink = 0i64;
  LockHandle.WorkItem.List.Blink = (_LIST_ENTRY *)&qword_140C4E0E8;
  CurrentIrql = v84;
  KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)&qword_140C4E0E8, v79, v80);
  if( MiGetPteLink(*((_QWORD *)Partition + 223)) != ((__int64)v7 - *((_QWORD *)Partition + 225)) >> 3 )
  {
LABEL_4:
    v8 = (INT64)RemoveListHeadPte((UINT64 *)Partition + 223);
    v9 = (_QWORD)MmGetPteBase() << 25;
    MiIncrementSystemCacheViewCount(((v8 << 25) - v9) >> 16);
    v10 = (_QWORD *)(v8 + 24);
    v11 = MiGetPteLink(*(_QWORD *)(v8 + 24));
    if( v11 )
    {
      if( v11 == 1 )
      {
        v3 = 1;
      }
      else
      {
        _InterlockedOr(v85, 0);
        v12 = MiGetPteLink(*(_QWORD *)(v8 + 16));
        v14 = (v13 - v12) & 0xFFFFF;
        if( v14 <= 2 && ((v12 & 1) != 0 || v14 < 2) )
        {
          v87 = (UINT64 *)(v8 + 24);
          v17 = v8;
          Routine = LockHandle.Routine;
          do
          {
            if( *(_DWORD *)LockHandle.ActivityId.Data4 )
            {
              v19 = v3++;
              v102[v19] = v17;
            }
            LockHandle.WorkItem.Parameter = (void *)(((v17 << 25) - v9) >> 16);
            MiInsertTbFlushEntry((INT64)&LockHandle.Type, (UINT64)LockHandle.WorkItem.Parameter, 64i64, 0i64);
            v20 = *v87;
            if( qword_140C4DC80 )
            {
              if( (v20 & 0x10) != 0 )
                LODWORD(v20) = v20 & 0xFFFFFFEF;
              else
                LODWORD(v20) = ~(_DWORD)qword_140C4DC80 & v20;
            }
            v21 = MiSwizzleInvalidPte(v20 & 0xFFFFFFF | 0x10000000);
            *v22 = v21;
            if( v3 == 12 )
              break;
            v23 = MiGetPteLink(*(_QWORD *)v17);
            v24 = *((_QWORD *)Partition + 225);
            if( v23 == ((__int64)Routine - v24) >> 3 )
              break;
            v17 = v24 + 8 * v23;
            v25 = *(_QWORD *)(v17 + 24);
            v87 = (UINT64 *)(v17 + 24);
          }
          while( MiGetPteLink(v25) == 2 );
          v88 = v3;
          v10 = (_QWORD *)(v8 + 24);
          v3 = v89;
        }
      }
    }
    KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
    if( *(_DWORD *)LockHandle.ActivityId.Data4 )
    {
      MiFlushTbList((__int64)&LockHandle.Type);
      v26 = v88;
      v89 = 0;
      if( v88 )
      {
        v27 = v89;
        do
        {
          LockHandle.Routine = (void(__fastcall *)(void *, void *, _IO_WORKITEM *))(v102[v27] + 24);
          v28 = MI_READ_PTE_LOCK_FREE((INT64)LockHandle.Routine);
          v29 = v28;
          if( qword_140C4DC80 )
          {
            if( (v28 & 0x10) != 0 )
              v29 = v28 & 0xFFFFFFEF;
            else
              v29 = v28 & ~(_DWORD)qword_140C4DC80;
          }
          v30 = MiSwizzleInvalidPte(v29 & 0xFFFFFFF);
          _InterlockedCompareExchange64((volatile signed __int64 *)LockHandle.Routine, v30, v31);
          ++v27;
        }
        while( v27 != v26 );
        v10 = (_QWORD *)(v8 + 24);
      }
    }
    __writecr8(CurrentIrql);
    v15 = (__int64)v90;
    if( v90 )
    {
      v32 = (ULONG_PTR)Partition + 1856;
      v33 = _InterlockedExchangeAdd64((volatile signed __int64 *)Partition + 232, 0xFFFFFFFFFFFFFFFFui64);
      if( (v33 & 2) != 0 && (v33 & 4) == 0 )
        ExfTryToWakePushLock((volatile INT64 *)Partition + 232);
      v34 = (_ETHREAD *)KeGetCurrentThread();
      v98 = 0;
      if( (unsigned int)MiGetSystemRegionType((UINT64)Partition + 1856) == 1 )
        v35 = MmGetSessionIdEx(*((_QWORD *)v34 + 23));
      else
        v35 = -1;
      --*((_WORD *)v34 + 243);
      ++*((_BYTE *)v34 + 794);
      v36 = (*((char *)v34 + 792) | *((char *)v34 + 870)) ^ 0x3F;
      v86 = *((_BYTE *)v34 + 794);
      v37 = !_BitScanReverse((unsigned int *)&v38, v36);
      v97 = v38;
      if( v37 )
        goto LABEL_43;
      while( 1 )
      {
        v39 = *((_QWORD *)v34 + 100) + 96 * v38;
        v36 &= ~(1 << v38);
        if( (*(_BYTE *)(v39 + 26) & 1) != 0
          && (*(_DWORD *)(v39 + 32) & 1) == 0
          && (*(_QWORD *)(v39 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v32 & 0x7FFFFFFFFFFFFFFCi64)
          && *(_DWORD *)(v39 + 40) == v35 )
        {
          *(_BYTE *)(v39 + 26) &= ~1u;
          if( *(_QWORD *)(v39 + 32) )
            break;
        }
        v37 = !_BitScanReverse((unsigned int *)&v38, v36);
        v97 = v38;
        if( v37 )
          goto LABEL_43;
      }
      if( !v39 )
      {
LABEL_43:
        if( (*((_DWORD *)v34 + 30) & 0x10000) == 0 )
          KeBugCheckEx(0x162u, (ULONG_PTR)v34, v32, v35, 0i64);
      }
      else
      {
        *(_BYTE *)(v39 + 32) |= 2u;
        if( *(__int64 *)(v39 + 32) < 0 )
          KiAbEntryRemoveFromTree(v39);
        v40 = *(_DWORD *)(v39 + 88) & 0x1FFFF;
        v41 = *(_DWORD *)(v39 + 88) & 0xFFFE0000;
        *(_BYTE *)(v39 + 25) &= ~1u;
        v98 = v40;
        *(_DWORD *)(v39 + 88) = v41;
        *(_QWORD *)(v39 + 32) = 0i64;
        v42 = (__int64)(v39 - *((_QWORD *)v34 + 100)) / 96;
        if( v86 == 1 )
          *((_BYTE *)v34 + 792) |= 1 << v42;
        else
          _InterlockedOr8((volatile signed __int8 *)v34 + 870, 1 << v42);
      }
      --*((_BYTE *)v34 + 794);
      KiAbThreadRemoveBoosts((ULONG_PTR)v34, v32, (unsigned int *)&v98);
      v37 = (*((_WORD *)v34 + 243))++ == 0xFFFF;
      if( v37 && *((_ETHREAD **)v34 + 19) != (_ETHREAD *)((char *)v34 + 152) )
        KiCheckForKernelApcDelivery();
      KiLeaveGuardedRegionUnsafe(v15);
    }
    if( v3 == 1 )
      MiWaitForSystemCacheViewFlush(v8);
    *(_QWORD *)v8 = ZeroPte;
    *(_QWORD *)(v8 + 8) = ZeroPte;
    *(_QWORD *)(v8 + 16) = ZeroPte;
    *v10 = ZeroPte;
    return(MMPTE *)v8;
  }
  KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
  __writecr8(v84);
  return 0i64;
}

Referenced by:

MmMapViewInSystemCache
MmReserveViewInSystemCache