MmSetPfnListInfo

__int64 __fastcall MmSetPfnListInfo(__int64 a1, _QWORD *a2, int a3){
  _QWORD *v7; 
  _ETHREAD *CurrentThread; 
  unsigned int v9; 
  int v10; 
  unsigned __int64 v11; 
  _MMPFN *v12; 
  unsigned __int64 v13; 
  char v14; 
  NTSTATUS PfnPriority; 
  UINT64 v16; 
  ULONG_PTR v17; 
  UINT8 *v18; 
  int v19; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v20; 
  unsigned __int64 v21; 
  __int64 v22; 
  __int128 PfnIdentity_8; 
  __int64 v24; 
  _ETHREAD *v25; 
  INT64 v26; 
  int v27; 
  char v28[132]; 

  v24 = 0i64;
  PfnIdentity_8 = 0i64;
  memset(v28, 0i64, sizeof(v28));
  if( a3 && !MiColdPageSizeSupported() )
    return 3221225659i64;
  v26 = 0i64;
  v27 = 16;
  v7 = &a2[3 * a1];
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v9 = 0;
  v25 = CurrentThread;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&stru_140C50B28 + 11, 0i64);
  if( a2 >= v7 )
    goto LABEL_32;
  v10 = a3;
  do
  {
    v11 = a2[1];
    if( v11 <= 0xFFFFFFFFFi64 && (MmGetPfnDb()[v11].u4._bf_0 & 0x4000000000000i64) != 0 )
    {
      *(_QWORD *)&PfnIdentity_8 = 0i64;
      v12 = &MmGetPfnDb()[v11];
      v24 = 0i64;
      *((_QWORD *)&PfnIdentity_8 + 1) = v11;
      v13 = MiLockPageInline(v12);
      MiIdentifyPfn(v12, (_MMPFN_IDENTITY *)&PfnIdentity_8);
      if( v24 != a2[2] )
        goto LABEL_28;
      if( (((unsigned __int64)PfnIdentity_8 ^ *a2) & 0x1FFFFFFFFFFFE00i64) != 0 )
        goto LABEL_28;
      v14 = *(_BYTE *)(&v12->u3 + 1) & 7;
      if( v14 != 6 && (unsigned __int8)(v14 - 2) > 2u )
        goto LABEL_28;
      if( v10 )
      {
        if( (*a2 & 0x80u) != 0i64 && v14 == 2 && !v12->u3.ReferenceCount )
        {
          if( MiColdPageSizeSupported() || (LOBYTE(v19) = MiIsPfnFileOnly((INT64)v12), v19) )
          {
            v20.Long = (unsigned __int64)v12->OriginalPte.u;
            v21 = (v20.Long & 0x400) != 0 ? v20.Long >> 11 : v20.Long >> 3;
            if( (v21 & 1) == 0 )
            {
              MiSetNonResidentPteHeat(&v12->OriginalPte.u.Long, 1i64);
              _InterlockedAnd64(&v12->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
              __writecr8(v13);
              MiAddPageToHeatList(&v26, v11, 3i64);
              goto LABEL_30;
            }
          }
        }
LABEL_28:
        _InterlockedAnd64(&v12->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
        __writecr8(v13);
        v24 |= 2ui64;
        v9 = -1073741788;
        v22 = v24;
        *(_OWORD *)a2 = PfnIdentity_8;
        a2[2] = v22;
        goto LABEL_30;
      }
      PfnPriority = MiGetPfnPriority(v12);
      if( (_DWORD)v16 != PfnPriority )
      {
        if( (_BYTE)v18 == 2 )
          MiRelinkStandbyPage(v17, v16, v18);
        else
          *((_BYTE *)&v12->u3 + 3) = v16 | *((_BYTE *)&v12->u3 + 3) & 0xF8;
      }
      _InterlockedAnd64(&v12->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v13);
    }
    else
    {
      v9 = -1073741584;
    }
LABEL_30:
    a2 += 3;
  }
  while( a2 < v7 );
  CurrentThread = v25;
LABEL_32:
  if( HIDWORD(v26) )
    MiNotifyPageHeat(&v26);
  if( _InterlockedCompareExchange64((_QWORD *)&stru_140C50B28 + 11, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((_EX_PUSH_LOCK *)&stru_140C50B28 + 11);
  KeAbPostRelease((char *)&stru_140C50B28 + 88);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return v9;
}

Referenced by: