MmAllocateIndependentPagesEx

__int64 __fastcall MmAllocateIndependentPagesEx(unsigned __int64 a1, int a2, _QWORD *a3, unsigned int a4){
  UINT64 v6; 
  _MMPTE *v7; 
  _KTBFLUSH_TYPE v8; 
  unsigned __int64 v9; 
  UINT64 v10; 
  unsigned __int64 v11; 
  UINT64 v12; 
  unsigned int v13; 
  __int64 v14; 
  unsigned int v15; 
  unsigned int NextPageColor; 
  __int64 v17; 
  UINT64 v18; 
  __int64 v19; 
  unsigned __int64 v20; 
  int v21; 
  int v22; 
  __int64 v23; 
  unsigned int v25; 
  _QWORD *v26; 
  __int64 v27; 
  NTSTATUS HasShadow; 
  UINT64 v29; 
  __int64 v30; 
  __int64 v31; 
  __int128 ColorBase; 
  UINT64 v33[4]; 
  __int128 v34; 
  _BOOL4 v35; 

  v6 = (a1 >> 12) + ((a1 & 0xFFF) != 0);
  ColorBase = 0i64;
  memset(v33, 0, sizeof(v33));
  v34 = 0i64;
  v7 = MiReservePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), (unsigned int)v6);
  if( !v7 )
    return 0i64;
  if( !MiObtainPoolCharges(v6, 1i64) )
  {
    MiReleasePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), v7, (unsigned int)v6, v8);
    return 0i64;
  }
  v35 = a3 && (dword_140C50AC4[0] & 8) != 0 && (a2 == -1 || KeNumberNodes == 1);
  v31 = (__int64)(((_QWORD)v7 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  LODWORD(v9) = MiMakeValidPte((_XSTATE_CONFIGURATION *)v7, 0i64, 2684354564i64);
  v10 = 0i64;
  v11 = v9;
  if( a2 != -1 )
    v10 = (unsigned int)(a2 + 1);
  MiInitializePageColorBase(0i64, v10, (_MI_COLOR_BASE *)&ColorBase);
  v12 = 0i64;
  v30 = 0i64;
  do
  {
    v13 = 0;
    NextPageColor = MiGetNextPageColor((INT64)&ColorBase);
    if( v35 )
    {
      if( a3 != (_QWORD *)-1i64 )
      {
        v25 = 0;
        if( !a4 )
          goto LABEL_9;
        v26 = a3;
        while( v14 != *v26 >> 12 )
        {
          v25 += v15;
          ++v26;
          if( v25 >= a4 )
            goto LABEL_9;
        }
      }
      v13 = v15;
    }
LABEL_9:
    while( 1 )
    {
      if( v13 )
      {
        LODWORD(v29) = 0;
        LODWORD(v27) = MiGetSlabPage((INT64)&Irp, v15, 0i64, (INT64 *)0xFFFFFFFFFFFFFFFFi64, v29);
        v19 = v27;
        if( v27 != -1 )
          break;
      }
      LODWORD(v17) = MiGetPage((ULONG_PTR *)&Irp.Core.PartitionId, NextPageColor, 8ui64);
      v19 = v17;
      if( v17 != -1 )
        goto LABEL_11;
      MiWaitForFreePage(&Irp, v18);
      v15 = 1;
    }
    ++v12;
LABEL_11:
    v11 ^= (v11 ^ (v19 << 12)) & 0xFFFFFFFFF000i64;
    MiInitializePfn((_RTL_BITMAP_EX *)&MmGetPfnDb()[v19], &v7->u.Long, 4ui64);
    v20 = v11;
    v21 = 0;
    LOBYTE(v22) = MiPteInShadowRange((UINT64)v7);
    if( !v22 )
    {
      v23 = 1i64;
      goto LABEL_13;
    }
    HasShadow = MiPteHasShadow();
    v23 = 1i64;
    if( HasShadow )
    {
      v21 = 1;
      if( *(&stru_140C4DB30 + 537) )
        goto LABEL_13;
    }
    else if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) == 0 )
    {
      goto LABEL_13;
    }
    if( (v11 & 1) != 0 )
      v20 = v11 | 0x8000000000000000ui64;
LABEL_13:
    v7->u.Long = v20;
    if( v21 )
      MiWritePteShadow();
    ++v7;
    v30 += v23;
    v6 -= v23;
  }
  while( v6 );
  if( v12 )
  {
    v33[3] = v12;
    v33[0] = v12;
    *(_OWORD *)&v33[1] = 0i64;
    v34 = 0i64;
    MiReturnPoolCharges(v33, (unsigned int)v23);
  }
  return v31;
}

Referenced by: