MxCreateFreePfns

VOID __stdcall MxCreateFreePfns(_MEMORY_ALLOCATION_DESCRIPTOR *MemoryDescriptor){
  unsigned __int64 BasePage; 
  unsigned __int64 PageCount; 
  int v3; 
  _TYPE_OF_MEMORY MemoryType; 
  __int64 v5; 
  _MMPFN *PfnDb; 
  _MMPFN *v7; 
  $559D8309DABD45803AD694472C7FC28A *v8; 
  unsigned __int16 ReferenceCount; 
  _QWORD *v10; 
  unsigned __int64 Long; 
  _MMPFN *v12; 
  int v13; 
  int v14; 
  __int64 v15; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  unsigned int v18; 
  unsigned int i; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  INT64 v25; 
  unsigned __int64 v26; 
  UINT8 v27; 
  NTSTATUS v28; 
  unsigned int v29; 
  unsigned int v30; 
  unsigned __int8 CurrentIrql; 
  unsigned __int64 v32; 
  _MMPFN *v33; 
  __m128i *v34; 
  INT64 v35; 
  UINT64 v36; 
  UINT64 v37; 
  INT64 v38; 
  INT64 v39; 
  INT64 v40; 
  _MMPFN *v41; 
  __int64 v42; 
  unsigned int v43; 
  _QWORD v44[3]; 
  INT64 v45[2]; 
  __int128 v46; 
  __int128 v47; 
  int v48; 
  unsigned __int64 v49; 
  unsigned __int8 v50; 
  _BOOL4 v51; 
  UINT64 SpinCount; 

  BasePage = MemoryDescriptor->BasePage;
  PageCount = MemoryDescriptor->PageCount;
  v3 = 0;
  *(_OWORD *)v45 = 0i64;
  v46 = 0i64;
  v47 = 0i64;
  if( !BasePage )
  {
    if( !--PageCount )
      return;
    BasePage = 1i64;
  }
  MemoryType = MemoryDescriptor->MemoryType;
  if( MemoryType == LoaderFree || (v5 = 1i64, MemoryType == LoaderZero) )
    v5 = 0i64;
  v42 = v5;
  PfnDb = MmGetPfnDb();
  v51 = MemoryType != LoaderZero;
  v7 = &PfnDb[BasePage];
  v41 = 0i64;
  v8 = 0i64;
  if( !PageCount )
    goto LABEL_48;
  do
  {
    if( v5 )
    {
      ReferenceCount = v7->u3.ReferenceCount;
      if( ReferenceCount == 1 )
      {
        v10 = (_QWORD *)(v7->PteLong | 0x8000000000000000ui64);
        Long = ZeroPte.u.Long;
        v12 = &PfnDb[v7->u4._bf_0 & 0xFFFFFFFFFi64];
        v48 = v3;
        LOBYTE(v13) = MiPteInShadowRange((UINT64)v10);
        v3 = 0;
        if( v13 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 )
        {
          v14 = v48;
          if( (ZeroPte.u.Long & 1) != 0 )
            Long = ZeroPte.u.Long | 0x8000000000000000ui64;
        }
        else
        {
          v14 = v48;
        }
        *v10 = Long;
        if( v14 )
          MiWritePteShadow();
        v15 = v12->u2._bf_0 ^ ((v12->u2._bf_0 - 1) ^ v12->u2._bf_0) & 0x3FFFFFFFFFFFFFFFi64;
        v12->u2._bf_0 = v15;
        if( (v15 & 0x3FFFFFFFFFFFFFFFi64) == 1 )
        {
          MiFreeEmptyBootPageTable(v12);
          v3 = 0;
        }
        v5 = v42;
        v7->u3.ReferenceCount = v3;
        v7->u2._bf_0 &= 0xC000000000000000ui64;
      }
      else if( ReferenceCount )
      {
        goto LABEL_46;
      }
    }
    if( (BasePage & 0x1FF) != 0 || v5 || PageCount < 0x200 )
    {
      v7->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = (__int64)v8;
      v8 = ($559D8309DABD45803AD694472C7FC28A *)v7;
      v41 = v7;
LABEL_46:
      ++BasePage;
      ++v7;
      --PageCount;
      goto LABEL_47;
    }
    MiRestrictRangeToNode(BasePage, PageCount);
    v49 = v16;
    v17 = v16;
    if( v16 < 0x200 )
    {
      v7->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = (__int64)v8;
      ++BasePage;
      v8 = ($559D8309DABD45803AD694472C7FC28A *)v7;
      v41 = v7++;
      --PageCount;
      goto LABEL_44;
    }
    v18 = (((unsigned __int64)KeFeatureBits >> 37) & 1) == 0;
    v43 = v18;
    for( i = v18; i <= 1; ++i )
    {
      v20 = MiLargePageSizes[i];
      if( BasePage != (BasePage & ~(v20 - 1)) || v17 < v20 )
        continue;
      v21 = v17;
      if( i == v18 )
      {
        v24 = v17;
      }
      else
      {
        v22 = MiLargePageSizes[i - 1];
        v23 = v22 - (BasePage & (v22 - 1));
        if( v23 <= v17 )
          v21 = v23;
        v24 = v21;
      }
      v25 = v21 - v24 % v20;
      LODWORD(v40) = 0;
      LODWORD(v38) = MiDetermineNewPfnHeatState(0i64) == 0;
      MiInitializeAllResidentPageBasePfns(&Irp.Core.PartitionId, BasePage, v25, i, 1, v38, v40);
      LODWORD(v39) = 0;
      MiCreateInitialLargeLeafPfns(BasePage, v25, i, 1, 0, v39);
      if( v25 )
      {
        v26 = v49;
        do
        {
          v27 = MiLockPageInline(v7);
          v44[1] = v51;
          v44[0] = BasePage;
          v44[2] = v27;
          MiInsertLargePageInNodeList((__int64)v44);
          v26 -= v20;
          PageCount -= v20;
          BasePage += v20;
          v7 += v20;
          v25 -= v20;
        }
        while( v25 );
        v49 = v26;
        v18 = v43;
      }
      v17 = v49;
      if( v49 < 0x200 )
        break;
      i = v18 - 1;
    }
    v8 = ($559D8309DABD45803AD694472C7FC28A *)v41;
LABEL_44:
    v3 = 0;
LABEL_47:
    v5 = v42;
    PfnDb = MmGetPfnDb();
  }
  while( PageCount );
LABEL_48:
  v28 = MiDetermineNewPfnHeatState(0i64);
  v30 = v29 | 0x400;
  if( !v28 )
    v30 = v29;
  MiCreatePfnTemplate(v51, (INT64)v45);
  CurrentIrql = KeGetCurrentIrql();
  v50 = CurrentIrql;
  __writecr8(v32);
  if( v8 )
  {
    v33 = MmGetPfnDb();
    do
    {
      v34 = (__m128i *)v8;
      v8 = ($559D8309DABD45803AD694472C7FC28A *)v8->_bf_0;
      MiCreateInitialPfns(v34, 1i64, (__m128i *)v45);
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64(&v34[1].m128i_i32[2], 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( v34[1].m128i_i64[1] < 0 );
      }
      MiInsertPageInFreeOrZeroedList(((char *)v34 - (char *)v33) / 48, v30, v35, v36, v37, v38);
      _InterlockedAnd64(&v34[1].m128i_i64[1], 0x7FFFFFFFFFFFFFFFui64);
    }
    while( v8 );
    CurrentIrql = v50;
  }
  __writecr8(CurrentIrql);
}

Referenced by: