MiLinkPoolCommitChain

CHAR __fastcall MiLinkPoolCommitChain(INT64 a1, UINT64 a2){
  UINT64 v2; 
  UINT64 v3; 
  UINT64 v5; 
  INT64 CurrentThread; 
  char *i; 
  ULONG_PTR v8; 
  __int64 v9; 
  __int64 v10; 
  int v11; 
  _MMPTE *PteBase; 
  INT64 *v13; 
  INT64 v14; 
  __int64 v15; 
  ULONG_PTR v16; 
  char *v17; 
  __int64 v18; 
  INT64 ValidPte; 
  INT64 ContainingPageTable; 
  ULONG_PTR BugCheckParameter4; 
  v2 = a2;
  v3 = (a2 & 0xFFFFFFFFFFFFF000ui64) + 4088;
  if( v3 > *(_QWORD *)(a1 + 56) )
    v3 = *(_QWORD *)(a1 + 56);
  if( (*(_BYTE *)(a1 + 78) & 4) != 0 )
  {
    PteBase = MmGetPteBase();
    v13 = (INT64 *)((char *)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64));
    MI_READ_PTE_LOCK_FREE((INT64)v13);
    v14 = MiSwizzleInvalidPte(768i64);
    if( v15 != v14 && (unsigned int)MiIsPoolPteInUse(v15) )
      KeBugCheckEx(0x1Au, 0x5304ui64, (__int64)((v2 << 25) - ((_QWORD)PteBase << 25)) >> 16, v16, 0i64);
    v17 = *(char **)(a1 + 16);
    *(_QWORD *)(a1 + 24) += 512i64;
    *(_QWORD *)(a1 + 16) = *(_QWORD *)v17;
    LODWORD(BugCheckParameter4) = 1;
    v18 = (v17 - (char *)MmGetPfnDb()) / 48;
    MiUpdateLargePageBitMap((UINT64)&MiSystemPartition, v18, 0x200ui64, 1ui64, BugCheckParameter4);
    ValidPte = MiMakeValidPte(0i64, v18, (*(unsigned __int16 *)(a1 + 78) >> 3) & 0x1F | 0xA4000000);
    if( v13 < (INT64 *)MmGetPml4eBase() || v13 > (INT64 *)MmGetPml4eLimit() )
      *v13 = ValidPte;
    else
      MiWriteTopLevelPxe(v13, ValidPte);
    ContainingPageTable = MiGetContainingPageTable((UINT64)v13);
    MiLockAndIncrementShareCount(ContainingPageTable);
    MiInitializeLargeNonPagedPoolLeafFrames((_MMPTE *)v2, v18);
  }
  else
  {
    MiFlushTbAsNeeded(a2, ((__int64)(v3 - a2) >> 3) + 1, *(_DWORD *)(a1 + 44), 1);
    v5 = *(_QWORD *)(a1 + 32);
    LOBYTE(CurrentThread) = 0;
    for( i = (char *)MmGetPteBase() + 0x4000000000i64; v2 <= v3; v2 += 8i64 )
    {
      v8 = *(_QWORD *)v2;
      MiPteInShadowRange(v2);
      CurrentThread = v8 & 0x3E0;
      if( (v8 & 0xC01) == 0 && CurrentThread == 0 )
      {
        if( v5 )
          v9 = (__int64)(v5 - (_QWORD)i) >> 3;
        else
          v9 = 0xFFFFFFFFFi64;
        CurrentThread = MiSwizzleInvalidPte(v9 << 28);
        v10 = CurrentThread | 0x3E0;
        if( v11 )
        {
          CurrentThread = (INT64)KeGetCurrentThread();
          if( (*(_DWORD *)(*(_QWORD *)(CurrentThread + 184) + 2172i64) & 0x1000) != 0 && (v10 & 1) != 0 )
            v10 |= 0x8000000000000000ui64;
        }
        *(_QWORD *)v2 = v10;
        v5 = v2;
      }
      else if( (v8 & 1) == 0 )
      {
        LOBYTE(CurrentThread) = CurrentThread == 992;
        if( (((v8 & 0xC00) == 0) & (unsigned __int8)CurrentThread) != 0 )
          KeBugCheckEx(0x1Au, 0x5308ui64, v2, v8, 0i64);
      }
    }
    *(_QWORD *)(a1 + 32) = v5;
  }
  return CurrentThread;
}

Referenced by: