MmDeleteKernelStack

VOID __stdcall MmDeleteKernelStack(PVOID PointerKernelStack, UINT64 DeleteFlags){
  unsigned int v2; 
  _MMPTE *PteBase; 
  INT64 v4; 
  UINT64 v5; 
  UINT64 v6; 
  _MMPFN *PfnDb; 
  __int64 v8; 
  __int64 v9; 
  unsigned int v10; 
  UINT64 v11; 
  unsigned __int8 CurrentIrql; 
  INT64 v13; 
  unsigned __int64 v14; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v16; 
  __int64 v17; 
  union _SLIST_HEADER *v18; 
  INT64 v19; 
  unsigned __int8 v20; 
  int v21; 
  int v22; 
  INT64 v23; 
  unsigned __int64 v24; 
  __int64 *v25; 
  unsigned __int64 v26; 
  _MMPFN *v27; 
  char *v28; 
  unsigned __int64 v29; 
  __int64 v30; 
  int v31; 
  UINT8 *v32; 
  int i; 
  int v34; 
  UINT64 v35; 
  unsigned __int64 v36; 
  __int64 v37; 
  UINT64 v38; 
  UINT64 v39; 
  INT64 v40; 
  __int64 v41; 
  UINT64 SpinCount; 
  unsigned int v43; 
  unsigned __int64 v44; 
  UINT64 v45; 
  v43 = DeleteFlags;
  v35 = 0i64;
  v2 = DeleteFlags;
  PteBase = MmGetPteBase();
  v4 = (INT64)PteBase + (((unsigned __int64)PointerKernelStack >> 9) & 0x7FFFFFFFF8i64) - 8;
  v40 = v4;
  v5 = *(_QWORD *)v4;
  v38 = *(_QWORD *)v4;
  v6 = v38;
  MiPteInShadowRange((UINT64)&v38);
  PfnDb = MmGetPfnDb();
  if( *(ULONG_PTR **)(qword_140C4E388
                     + 8 * ((*((_QWORD *)PfnDb + 6 * ((v6 >> 12) & 0xFFFFFFFFFi64) + 5) >> 39) & 0x3FFi64)) != &MiSystemPartition
    || (v2 & 1) != 0 )
  {
LABEL_56:
    MiDeleteKernelStack((_MMPTE *)v4, v2);
    return;
  }
  v39 = v5;
  MiPteInShadowRange((UINT64)&v39);
  LODWORD(v8) = MiSearchNumaNodeTable((PVOID)((__int64)(48 * ((v5 >> 12) & 0xFFFFFFFFFi64)) / 48));
  v9 = 0i64;
  v37 = 0i64;
  v10 = *(_DWORD *)(v8 + 8);
  LODWORD(v44) = v10;
  if( (v2 & 4) == 0 )
    goto LABEL_18;
  MiPteInShadowRange((UINT64)&v35);
  while( 1 )
  {
    v35 = MI_READ_PTE_LOCK_FREE(v4);
    v11 = (UINT64)PfnDb + 48 * ((v35 >> 12) & 0xFFFFFFFFFi64);
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)(v11 + 24), 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( *(__int64 *)(v11 + 24) < 0 );
    }
    v13 = MI_READ_PTE_LOCK_FREE(v4);
    if( v35 == v13 )
      break;
    _InterlockedAnd64((volatile signed __int64 *)(v11 + 24), 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(CurrentIrql);
  }
  v14 = (*(_QWORD *)v11 & 0xFFFFFFFFFFEi64) != 0 ? 8 * (*(_QWORD *)v11 & 0xFFFFFFFFFFEi64 | 0xFFFFF00000000000ui64) : 0i64;
  _InterlockedAnd64((volatile signed __int64 *)(v11 + 24), 0x7FFFFFFFFFFFFFFFui64);
  v10 = v44;
  __writecr8(CurrentIrql);
  PteBase = MmGetPteBase();
  v9 = 0i64;
  v37 = 0i64;
  if( v14 != -32i64 )
  {
LABEL_18:
    v17 = 176i64 * v10;
    v41 = v17;
    while( 1 )
    {
      v18 = (PSLIST_HEADER)((char *)SListHead + 32 * v9 + v17);
      if( *(_WORD *)v18 < *((int *)v18 + 4) )
      {
        v19 = ((v4 << 25) - ((_QWORD)PteBase << 25)) >> 16;
        *(_QWORD *)(v19 + 0xFE0) = v19 ^ qword_140C4EC08;
        if( v9 == 1 )
        {
          RtlpInterlockedPushEntrySList(v18, (PSLIST_ENTRY)(v19 + 4080));
          return;
        }
        v20 = KeGetCurrentIrql();
        __writecr8(2ui64);
        v21 = 1;
        v36 = 0i64;
        v22 = -1;
        v23 = v4 - 8i64 * (unsigned __int8)byte_140C4E8FC;
        v24 = v23 + 8i64 * ((unsigned int)(unsigned __int8)byte_140C4E8FC + 1);
        v25 = (__int64 *)(v23 + 8);
        v44 = v24;
        if( (unsigned __int64)v25 >= v24 )
          goto LABEL_53;
        do
        {
          v36 = *v25;
          v26 = v36;
          if( (v36 & 1) != 0 )
          {
            v27 = MmGetPfnDb();
            v28 = (char *)v27 + 48 * ((v36 >> 12) & 0xFFFFFFFFFi64);
            LODWORD(v45) = 0;
            if( _interlockedbittestandset64((volatile signed __int32 *)v28 + 6, 0x3Fui64) )
            {
              do
              {
                do
                  KeYieldProcessorEx(&v45);
                while( *((__int64 *)v28 + 3) < 0 );
              }
              while( _interlockedbittestandset64((volatile signed __int32 *)v28 + 6, 0x3Fui64) );
              v27 = MmGetPfnDb();
            }
            if( v26 == *v25 )
            {
              v29 = (v28 - (char *)v27) / 48;
              if( v22 == -1 )
              {
                LODWORD(v30) = MiSearchNumaNodeTable((PVOID)((v28 - (char *)v27) / 48));
                v22 = *(_DWORD *)(v30 + 8);
              }
              else
              {
                v31 = dword_140C4DBC8;
                if( dword_140C4DBC4 > (unsigned int)dword_140C4DBC8
                  || (v32 = &qword_140C4DC08[16 * dword_140C4DBC4], v29 < *(_QWORD *)v32)
                  || dword_140C4DBC4 != dword_140C4DBC8 && v29 >= *((_QWORD *)v32 + 2) )
                {
                  for( i = 0; ; i = v34 + 1 )
                  {
                    while( 1 )
                    {
                      if( v31 < i )
                        KeBugCheckEx(0x1Au, 0x6201ui64, v29, 0i64, 0i64);
                      v34 = (i + v31) >> 1;
                      v32 = &qword_140C4DC08[16 * v34];
                      if( v29 >= *(_QWORD *)v32 )
                        break;
                      if( !v34 )
                        KeBugCheckEx(0x1Au, 0x6200ui64, v29, (ULONG_PTR)v32, 0i64);
                      v31 = v34 - 1;
                    }
                    if( v34 == dword_140C4DBC8 || v29 < *((_QWORD *)v32 + 2) )
                      break;
                  }
                  dword_140C4DBC4 = (i + v31) >> 1;
                }
                if( v22 != *((_DWORD *)v32 + 2) )
                  v21 = 0;
              }
              *(_QWORD *)v28 &= 0xFFFFF00000000001ui64;
              ++v25;
            }
            _InterlockedAnd64((volatile signed __int64 *)v28 + 3, 0x7FFFFFFFFFFFFFFFui64);
          }
          else
          {
            ++v25;
          }
        }
        while( (unsigned __int64)v25 < v44 );
        if( v21 == 1 )
        {
LABEL_53:
          RtlpInterlockedPushEntrySList(v18, (PSLIST_ENTRY)(v19 + 4080));
          __writecr8(v20);
          return;
        }
        __writecr8(v20);
        v9 = v37;
        v4 = v40;
      }
      if( v9 != 1 )
        break;
      v17 = v41;
      v9 = 0i64;
      PteBase = MmGetPteBase();
      v37 = 0i64;
    }
    v2 = v43;
    goto LABEL_56;
  }
  CurrentPrcb = KeGetCurrentPrcb();
  if( *(unsigned __int16 *)(*((_QWORD *)CurrentPrcb + 24) + 146i64) != (_DWORD)v44
    || *((_QWORD *)CurrentPrcb + 4065)
    || (v16 = ((v4 << 25) - ((_QWORD)PteBase << 25)) >> 16,
        *(_QWORD *)(v16 + 4064) = v16 ^ qword_140C4EC08,
        _InterlockedCompareExchange64((volatile signed __int64 *)CurrentPrcb + 4065, v16 + 4080, 0i64)) )
  {
    v9 = 1i64;
    v37 = 1i64;
    goto LABEL_18;
  }
}

Referenced by: