MiUnmapRetpolineStubs

NTSTATUS __stdcall MiUnmapRetpolineStubs(INT64 a1, INT64 a2){
  int v2; 
  INT64 v4; 
  char *v5; 
  VOID *v6; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  __int64 v8; 
  int v9; 
  _MMSUPPORT_INSTANCE *v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  char *v13; 
  __int64 v14; 
  char v15; 
  char v16; 
  unsigned __int64 *v17; 
  VOID *v18; 
  __int64 v19; 
  INT64 v20; 
  char WsleContents; 
  INT64 v22; 
  unsigned __int64 Long; 
  int v24; 
  _MMPFN *PfnDb; 
  __int64 v26; 
  UINT64 v27; 
  NTSTATUS result; 
  char v29; 
  __int64 v30; 
  unsigned __int64 v31; 
  __int64 v32; 
  _MI_TB_FLUSH_LIST TbFlushList[48]; 

  v2 = a2;
  memset(TbFlushList, 0i64, 0xB8u);
  v5 = 0i64;
  v6 = *(VOID **)(a1 + 48);
  if( v2 )
    AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v6);
  else
    AnyMultiplexedVm = MiGetSessionVm(v4, (INT64)v6, *(_DWORD *)(a1 + 64) >> 12);
  v10 = AnyMultiplexedVm;
  v11 = v8 + ((((unsigned int)dword_140C4C9F0 >> 12) + v9 + ((dword_140C4C9F0 & 0xFFF) != 0)) << 12);
  v31 = v11;
  v12 = qword_140C4C990;
  v13 = (char *)MmGetPteBase() + ((v11 >> 9) & 0x7FFFFFFFF8i64);
  v32 = qword_140C4C990;
  LOWORD(TbFlushList[1]) = 0;
  TbFlushList[2] = 20;
  *(_QWORD *)&TbFlushList[4] = 0i64;
  *(_QWORD *)&TbFlushList[6] = 0i64;
  TbFlushList[0] = v2 == 0 ? 2 : 0;
  MiLockWorkingSetShared();
  v14 = 0i64;
  v29 = v15;
  v16 = v15;
  if( dword_140C4C9C8 )
  {
    while( 1 )
    {
      v30 = *(_QWORD *)(v12 + 8 * v14 + 48);
      v17 = (unsigned __int64 *)&v13[8 * v14];
      v18 = (VOID *)(v11 + (unsigned int)((_DWORD)v14 << 12));
      if( !v5 )
        goto LABEL_8;
      if( ((unsigned __int16)v17 & 0xFFF) == 0 )
        break;
LABEL_9:
      LODWORD(v19) = MI_READ_PTE_LOCK_FREE((INT64)&v13[8 * v14]);
      if( v19 )
      {
        WsleContents = MiGetWsleContents(v20, v11 + (unsigned int)((_DWORD)v14 << 12));
        MiWriteWsle(v22, v11 + (unsigned int)((_DWORD)v14 << 12), WsleContents & 0xF0 | 0xA);
        Long = ZeroPte.u.Long;
        LOBYTE(v24) = MiPteInShadowRange((UINT64)&v13[8 * v14]);
        if( v24 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
          Long = ZeroPte.u.Long | 0x8000000000000000ui64;
        *v17 = Long;
        MiInsertTbFlushEntry(TbFlushList, v18, 1ui64, 0i64);
        PfnDb = MmGetPfnDb();
        MiLockAndDecrementShareCount(&PfnDb[v30], 0i64);
        LODWORD(v26) = MiGetContainingPageTable((UINT64)&v13[8 * v14]);
        MiLockAndDecrementShareCount(&PfnDb[v26], 0i64);
        v11 = v31;
        v12 = v32;
      }
      v14 = (unsigned int)(v14 + 1);
      if( (unsigned int)v14 >= dword_140C4C9C8 )
      {
        v16 = v29;
        goto LABEL_17;
      }
    }
    MiFlushTbList(TbFlushList);
    MiUnlockPageTableInternal((INT64)v10, (UINT64)v5);
LABEL_8:
    v5 = (char *)MmGetPteBase() + (((unsigned __int64)v17 >> 9) & 0x7FFFFFFFF8i64);
    MiLockPageTableInternal((INT64)v10, (UINT64)v5, 0i64);
    goto LABEL_9;
  }
LABEL_17:
  MiFlushTbList(TbFlushList);
  if( v5 )
    MiUnlockPageTableInternal((INT64)v10, (UINT64)v5);
  LOBYTE(v27) = v16;
  MiUnlockWorkingSetShared(v10, v27);
  return result;
}

Referenced by: