MiRemoveLowestPriorityStandbyPage

UINT64 __stdcall MiRemoveLowestPriorityStandbyPage(_MI_PARTITION *Partition, UINT64 HighestPriority, UINT64 Flags){
  void *v3; 
  _QWORD *v4; 
  unsigned __int64 v5; 
  _LIST_ENTRY *v6; 
  __int64 v7; 
  unsigned __int8 CurrentIrql; 
  unsigned __int64 v9; 
  char *v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  INT64 v13; 
  __int64 v14; 
  unsigned __int64 v15; 
  __int64 v16; 
  int v17; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  volatile signed __int32 *v21; 
  unsigned int v22; 
  unsigned __int64 v23; 
  int v24; 
  __int64 v25; 
  INT64 v26; 
  __int64 v27; 
  __int64 v28; 
  INT64 updated; 
  __int64 v30; 
  __int64 v31; 
  __int64 v32; 
  UINT64 v33; 
  int v34; 
  WCHAR *v35; 
  UNICODE_STRING *v36; 
  unsigned __int64 v37; 
  int v38; 
  __int64 v39; 
  char v40; 
  char v41; 
  char v42; 
  ULONG_PTR AvailablePagesExcludeSlists; 
  struct _IO_WORKITEM LockHandle; 
  UINT64 SpinCount; 
  UINT64 Flagsa; 
  unsigned __int64 v48; 
  LODWORD(Flagsa) = Flags;
  v4 = (_QWORD *)((char *)Partition + 2432);
  memset(&LockHandle, 0, 24);
  v48 = (unsigned __int64)Partition + 32 * (unsigned int)HighestPriority + 8 * (unsigned int)HighestPriority + 2432;
  if( (unsigned __int64)Partition + 2432 >= v48 )
    return -1i64;
  v5 = v48;
  v6 = (_LIST_ENTRY *)((char *)Partition + 2464);
  v7 = 0xFFFFFFFFFi64;
  while( v4[2] == 0xFFFFFFFFFi64 )
  {
LABEL_40:
    v4 += 5;
    v6 = (_LIST_ENTRY *)((char *)v6 + 40);
    if( (unsigned __int64)v4 >= v5 )
      return -1i64;
  }
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  LockHandle.WorkItem.List.Blink = v6;
  LockHandle.WorkItem.List.Flink = 0i64;
  KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)v6, (WORK_QUEUE_TYPE)Flags, v3);
  v9 = v4[2];
  if( v9 == 0xFFFFFFFFFi64 )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
LABEL_39:
    __writecr8(CurrentIrql);
    v5 = v48;
    goto LABEL_40;
  }
  v10 = (char *)MmGetPfnDb() + 48 * v9;
  if( (unsigned int)MiIsDecayPfn(v4[2]) == 1 )
  {
    v7 = v9;
    v12 = *((_QWORD *)v10 + 2);
    v13 = (INT64)v10;
    if( qword_140C4DC80 && (v12 & 0x10) == 0 )
      v12 &= ~qword_140C4DC80;
    v9 = (v12 >> 12) & 0xFFFFFFFFFi64;
    v10 = (char *)(v11 + 48 * v9);
    if( v9 == v7 )
    {
      MiUnlinkPageFromList((_MMPFN *)v13, 1ui64);
      *(_BYTE *)(v13 + 35) &= ~8u;
      MiRemoveDecayClusterTimer(v13);
      KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
LABEL_12:
      v7 = 0xFFFFFFFFFi64;
LABEL_38:
      v4 -= 5;
      v6 = (_LIST_ENTRY *)((char *)v6 - 40);
      goto LABEL_39;
    }
  }
  else
  {
    v13 = 0i64;
  }
  if( !_interlockedbittestandset64((volatile signed __int32 *)v10 + 6, 0x3Fui64) )
  {
    v7 = 0xFFFFFFFFFi64;
    goto LABEL_33;
  }
  KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
  LODWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)v10 + 6, 0x3Fui64) )
  {
    do
      KeYieldProcessorEx(&SpinCount);
    while( *((__int64 *)v10 + 3) < 0 );
  }
  if( (v10[34] & 7) != 2
    || *(_MI_PARTITION **)(qword_140C4E388 + 8 * ((*((_QWORD *)v10 + 5) >> 39) & 0x3FFi64)) != Partition )
  {
    goto LABEL_30;
  }
  LockHandle.WorkItem.List.Blink = v6;
  LockHandle.WorkItem.List.Flink = 0i64;
  KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)v6, (WORK_QUEUE_TYPE)Flags, v3);
  v14 = v4[2];
  if( !v13 )
  {
    if( v9 == v14 )
    {
      v7 = 0xFFFFFFFFFi64;
      goto LABEL_33;
    }
    KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
LABEL_30:
    _InterlockedAnd64((volatile signed __int64 *)v10 + 3, 0x7FFFFFFFFFFFFFFFui64);
    goto LABEL_12;
  }
  if( v7 != v14 )
  {
    v7 = 0xFFFFFFFFFi64;
    KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
    goto LABEL_37;
  }
  v15 = *(_QWORD *)(v13 + 16);
  if( qword_140C4DC80 && (v15 & 0x10) == 0 )
    v15 &= ~qword_140C4DC80;
  v7 = 0xFFFFFFFFFi64;
  if( v9 != ((v15 >> 12) & 0xFFFFFFFFFi64) )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
LABEL_37:
    _InterlockedAnd64((volatile signed __int64 *)v10 + 3, 0x7FFFFFFFFFFFFFFFui64);
    goto LABEL_38;
  }
LABEL_33:
  if( MiIsPfnFromSlabAllocation((INT64)v10) )
  {
    v17 = MiUnlinkPageFromList((_MMPFN *)v10, 1ui64);
    KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
    if( v17 )
    {
      v10[35] &= 0xF8u;
      MiInsertPageInList((_MMPFN *)v10, 0x800ui64);
    }
    else
    {
      MiDiscardTransitionPteEx((UINT64)v10, 0i64);
    }
    goto LABEL_37;
  }
  if( !*v4 )
  {
    AvailablePagesExcludeSlists = MiGetAvailablePagesExcludeSlists((INT64)Partition);
    KeBugCheckEx(0x4Eu, 1ui64, (ULONG_PTR)v4, AvailablePagesExcludeSlists, 0i64);
  }
  --*v4;
  if( dword_140C4E40C == 1 )
  {
    v19 = v9 & 0x1F;
    LOBYTE(v20) = 1;
    v21 = (volatile signed __int32 *)(qword_140C4E468 + 4 * (v9 >> 5));
    if( v19 + 1 <= 0x20 )
    {
      v22 = 1 << v19;
      goto LABEL_52;
    }
    if( (v9 & 0x1F) == 0 )
      goto LABEL_51;
    _InterlockedOr(v21++, ((1 << (32 - (v9 & 0x1F))) - 1) << v19);
    v20 = 1i64 - (32 - (unsigned int)(v9 & 0x1F));
    if( v20 >= 0x20 )
    {
      v23 = v20 >> 5;
      v20 += -32i64 * (v20 >> 5);
      do
      {
        *v21++ = -1;
        --v23;
      }
      while( v23 );
    }
    if( v20 )
    {
LABEL_51:
      v22 = (1 << v20) - 1;
LABEL_52:
      _InterlockedOr(v21, v22);
    }
  }
  v24 = 0;
  v25 = *(_QWORD *)v10 & 0xFFFFFFFFFi64;
  if( (v10[35] & 8) != 0 )
  {
    if( (unsigned int)MiIsDecayPfn(*((_QWORD *)v10 + 3) & 0xFFFFFFFFFi64) == 1 && v26 == v27 )
    {
      MiDeleteParentDecayNode((_MMPFN *)v10);
      v24 = 1;
    }
    else
    {
      updated = MiUpdateTransitionPteFrame(*(_QWORD *)(v28 + 48 * v27 + 16), v26);
      *(_QWORD *)(v30 + 16) = updated;
      MiSetPfnBlink((_MMPFN *)(v32 + 48 * v31), v33, 0i64);
      v24 = 1;
    }
  }
  else
  {
    v4[2] = v25;
    if( v25 == 0xFFFFFFFFFi64 )
      v4[3] = 0xFFFFFFFFFi64;
    else
      MiSetPfnBlink((_MMPFN *)(v16 + 48 * v25), 0xFFFFFFFFFui64, 0i64);
  }
  MiUnlinkNumaStandbyPage((_MMPFN *)v10);
  if( v24 == 1 )
    v10[35] &= ~8u;
  KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
  v34 = MiDecreaseAvailablePages(Partition, 1ui64, 0xFFFFFFFFFFFFFFFFui64, (unsigned int)Flagsa);
  *((_QWORD *)v10 + 3) &= 0xFFFFFFF000000000ui64;
  MiRestoreTransitionPte((_MMPFN *)v10, 0i64);
  v36 = (UNICODE_STRING *)*((_QWORD *)v10 + 2);
  v37 = (unsigned __int64)v36 >> 11;
  if( ((unsigned __int16)v36 & 0x400) == 0 )
    v37 = (unsigned __int64)v36 >> 3;
  LOBYTE(v38) = MI_PFN_IS_PROTO((UNICODE_STRING *)v10, v36, v37, v35);
  v39 = 4352i64;
  if( !v38 )
    v39 = 5056i64;
  _InterlockedDecrement64((volatile signed __int64 *)((char *)Partition + v39));
  v40 = v10[34];
  *((_QWORD *)v10 + 5) &= ~0x8000000000000000ui64;
  v10[34] = v40 & 0xC7;
  v41 = v10[35] & 0xDF;
  *(_QWORD *)v10 = 0i64;
  v10[35] = v41;
  v10[34] = v10[34] & 0xF8 | 5;
  *((_QWORD *)v10 + 2) = ZeroPte;
  MiSetOriginalPtePfnFromFreeList((UINT64 *)v10 + 2);
  if( (v42 & 1) != 0 )
    *((_QWORD *)v10 + 2) = MiUpdatePageFileHighInPte(*((_QWORD *)v10 + 2), 4294967293i64);
  if( !v34 )
  {
    MiReturnFreeZeroPage((INT64)v10);
    _InterlockedAnd64((volatile signed __int64 *)v10 + 3, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(CurrentIrql);
    return -1i64;
  }
  _InterlockedAnd64((volatile signed __int64 *)v10 + 3, 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(CurrentIrql);
  return v9;
}

Referenced by: