MiRemoveLockedPageCharge

INT64 __fastcall MiRemoveLockedPageCharge(INT64 a1){
  UINT64 v1; 
  bool v2; 
  __int16 v3; 
  unsigned __int64 v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  unsigned int v8; 
  _MMPTE *PteBase; 
  UNICODE_STRING *v10; 
  char v11; 
  int v12; 
  unsigned __int64 v13; 
  __int64 v14; 
  int v15; 
  __int64 v16; 
  unsigned __int64 v17; 
  unsigned __int64 v18; 
  INT64 v19; 
  UINT64 v20; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v22; 
  __int64 v23; 
  unsigned __int64 v24; 
  unsigned __int64 v25; 
  unsigned __int64 v26; 
  struct _KPRCB *v27; 
  __int64 v28; 
  signed __int32 v29; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  v1 = *(unsigned __int16 *)(a1 + 32);
  if( !(_WORD)v1 )
    MiBadRefCount((_MMPFN *)a1, v1);
  v2 = (_WORD)v1 == 1;
  v3 = v1 - 1;
  *(_WORD *)(a1 + 32) = v3;
  if( v2 && (*(_QWORD *)(a1 + 40) & 0x2000000000000i64) != 0 )
    return 1i64;
  v5 = *(_QWORD *)(a1 + 40);
  if( (v5 & 0x1000000000i64) != 0 || (v5 & 0x2000000000000i64) != 0 )
    return 0i64;
  v6 = 1i64;
  v7 = *(_QWORD *)(a1 + 24) & 0x3FFFFFFFFFFFFFFFi64;
  if( !v3 )
  {
    v8 = 1;
    goto LABEL_16;
  }
  if( v3 == 1 )
  {
    if( v7 )
    {
LABEL_14:
      v8 = 0;
LABEL_16:
      PteBase = MmGetPteBase();
      v10 = (UNICODE_STRING *)(*(_QWORD *)(a1 + 8) | 0x8000000000000000ui64);
      if( v10 > (UNICODE_STRING *)((char *)PteBase + 0x3FFFFFFF78i64) || v10 < (UNICODE_STRING *)PteBase )
      {
        v11 = *(_BYTE *)(a1 + 35);
        if( (v11 & 0x20) != 0 )
        {
          *(_BYTE *)(a1 + 35) = v11 & 0xDF;
          return v8;
        }
      }
      LOBYTE(v12) = MI_PFN_IS_PROTO((UNICODE_STRING *)a1, v10, 0, *(PWCHAR *)(a1 + 24));
      if( v12 && (*(_DWORD *)(v14 + 16) & 0x400i64) != 0 )
      {
        v15 = 1;
      }
      else if( v13 <= v17 && v13 >= v18 && (*(_BYTE *)(v14 + 35) & 0x20) != 0 )
      {
        v15 = 1;
      }
      else if( v8 == 1 && (v16 & 0x4000000000000000i64) != 0 )
      {
        v15 = 1;
      }
      v19 = *(_QWORD *)(qword_140C4E388 + 8 * ((v5 >> 39) & 0x3FF));
      if( v15 == 1 )
      {
        v20 = 1i64;
        memset(&LockHandle, 0, sizeof(LockHandle));
        if( !*(_QWORD *)(v19 + 6264)
          || (KeAcquireInStackQueuedSpinLock((UINT64 *)(v19 + 6248), &LockHandle),
              v20 = MiRestockOverCommit(v19, 1ui64),
              KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle),
              __writecr8(LockHandle.OldIrql),
              v20) )
        {
          if( (ULONG_PTR *)v19 == &MiSystemPartition
            && (CurrentPrcb = KeGetCurrentPrcb(),
                _m_prefetchw((char *)CurrentPrcb + 33560),
                v22 = *((unsigned int *)CurrentPrcb + 8390),
                v20 + v22 <= 0x100) )
          {
            while( 1 )
            {
              v23 = _InterlockedCompareExchange((volatile signed __int32 *)CurrentPrcb + 8390, v22 + v20, v22);
              if( v23 == v22 )
                break;
              v22 = v23;
              if( v23 + v20 > 0x100 )
                goto LABEL_37;
            }
          }
          else
          {
LABEL_37:
            v24 = _InterlockedExchangeAdd64((volatile signed __int64 *)(v19 + 7464), -(__int64)v20);
            v25 = *(_QWORD *)(v19 + 6240);
            if( v24 >= v25 && v24 - v20 < v25 || (v26 = *(_QWORD *)(v19 + 6232), v24 - v20 < v26) && v24 >= v26 )
              MiSyncCommitSignals((_MI_PARTITION *)v19, 0i64);
          }
        }
      }
      if( (ULONG_PTR *)v19 != &MiSystemPartition )
        goto LABEL_53;
      v27 = KeGetCurrentPrcb();
      v28 = *((int *)v27 + 8391);
      if( (_DWORD)v28 == -1 )
        goto LABEL_53;
      if( (unsigned __int64)(v28 + 1) <= 0x100 )
      {
        do
        {
          v29 = _InterlockedCompareExchange((volatile signed __int32 *)v27 + 8391, v28 + 1, v28);
          v2 = (_DWORD)v28 == v29;
          LODWORD(v28) = v29;
          if( v2 )
            return v8;
        }
        while( v29 != -1 && (unsigned __int64)(v29 + 1i64) <= 0x100 );
      }
      if( (int)v28 > 192
        && (_DWORD)v28 != -1
        && (_DWORD)v28 == _InterlockedCompareExchange((volatile signed __int32 *)v27 + 8391, 192, v28) )
      {
        v6 = (int)v28 - 192 + 1i64;
      }
      if( v6 )
LABEL_53:
        _InterlockedExchangeAdd64((volatile signed __int64 *)(v19 + 7168), v6);
      return v8;
    }
  }
  else if( v3 != 2 || !v7 )
  {
    return 0i64;
  }
  if( (*(_BYTE *)(a1 + 34) & 8) != 0 )
    goto LABEL_14;
  return 0i64;
}

Referenced by: