MiDeleteVa

NTSTATUS __stdcall MiDeleteVa(INT64 a1, UINT64 a2, INT64 a3){
  unsigned __int64 v3; 
  _MMPTE *Pml4eBase; 
  int v6; 
  _MMPTE *PxeUserLimit; 
  UINT64 v9; 
  char v10; 
  _MMPTE *i; 
  __int64 v12; 
  _MMSUPPORT_INSTANCE *v13; 
  __int64 v14; 
  int v15; 
  unsigned __int64 v16; 
  _MMPTE *PteLimit; 
  UINT64 v18; 
  _MMPTE *v19; 
  _UNICODE_STRING *v20; 
  UINT8 v21; 
  wchar_t *v22; 
  _MMPFN *v23; 
  _MMPFN *v24; 
  int v25; 
  _MMPFN *v26; 
  UINT64 v27; 
  _MMSUPPORT_INSTANCE *v28; 
  unsigned __int64 v29; 
  int v30; 
  _MMPTE *PteBase; 
  INT64 v32; 
  _QWORD *v33; 
  wchar_t *v34; 
  int v35; 
  char v36; 
  _MMPFN *PfnDb; 
  bool v38; 
  __int64 v39; 
  int v40; 
  __int64 v41; 
  unsigned int v42; 
  _MMPTE *v43; 
  __int64 v44; 
  volatile __int64 *v45; 
  _MMPTE *v46; 
  _MMPTE *v47; 
  _UNICODE_STRING *v48; 
  _UNICODE_STRING *v49; 
  __int64 v50; 
  int v51; 
  INT64 v52; 
  int v53; 
  int v54; 
  INT64 v55; 
  unsigned __int64 Long; 
  volatile __int64 v57; 
  _MMPTE *v58; 
  _MMPTE *v59; 
  char v60; 
  _MMPFN *v61; 
  char v62; 
  int v63; 
  char v64; 
  unsigned int v65; 
  char v66; 
  __int64 v67; 
  __int64 v68; 
  unsigned __int64 v69; 
  __int64 v70; 
  __int64 v71; 
  unsigned __int64 v72; 
  __int64 v73; 
  unsigned __int64 v74; 
  unsigned int v75; 
  __int64 v76; 
  unsigned __int64 v77; 
  unsigned __int64 v79; 
  _MI_PAGE_DELETE_RESULT v80; 
  int v81; 
  VOID *v82; 
  _EPROCESS *v83; 
  _MMCLONE_DESCRIPTOR *CloneAddress; 
  ULONG_PTR v85; 
  ULONG_PTR v86; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v87; 
  _MMPTE *v88; 
  _MMPTE *v89; 
  __int64 PartitionId; 
  _MI_PARTITION *v91; 
  INT64 v92; 
  __int64 *v93; 
  unsigned __int64 PteShadow; 
  _MMPTE *v95; 
  _MMPFN *v96; 
  INT64 *BugCheckParameter4; 
  UINT64 v98; 
  _MMSUPPORT_INSTANCE *v99; 
  int v100; 
  int v101; 
  char v102; 
  int v103; 
  __int64 v104; 
  UINT64 SpinCount; 
  unsigned __int64 v106; 
  unsigned __int64 v107; 
  __int64 v108; 
  UINT64 v109; 
  INT64 v110; 
  unsigned __int64 v111; 
  UINT64 IoPageFrame; 
  _OWORD v113[2]; 

  v3 = *(_QWORD *)a2;
  Pml4eBase = MmGetPml4eBase();
  v6 = a3;
  v101 = a3;
  PxeUserLimit = MmGetPxeUserLimit();
  if( a2 >= (unsigned __int64)Pml4eBase && a2 <= (unsigned __int64)PxeUserLimit )
    Pml4eBase = MmGetPml4eBase();
  v109 = v3;
  if( !v3 )
  {
    if( !(_DWORD)a3 )
    {
      v9 = *(_QWORD *)(a1 + 88);
      v10 = 1;
      if( v9 > (a2 & 0xFFFFFFFFFFFFF000ui64) + 4088 )
        v9 = (a2 & 0xFFFFFFFFFFFFF000ui64) + 4088;
      for( i = (_MMPTE *)(a2 + 8); (unsigned __int64)i <= v9; ++i )
      {
        if( i >= Pml4eBase && i <= PxeUserLimit )
          Pml4eBase = MmGetPml4eBase();
        if( i->u.Long )
          break;
        if( !++v10 )
          break;
      }
      *(_BYTE *)(a1 + 3) = v10 - 1;
    }
    return 0;
  }
  v12 = *(_QWORD *)(a1 + 168);
  v13 = *(_MMSUPPORT_INSTANCE **)(a1 + 24);
  v14 = *(_QWORD *)(a1 + 16);
  v104 = v12;
  v15 = *(_DWORD *)(v12 + 104);
  v99 = v13;
  v16 = (__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  if( (v3 & 1) != 0 )
  {
    if( v6 >= 1 )
    {
      if( (v3 & 0x80u) != 0i64 )
      {
LABEL_19:
        MiDeleteLargeUserPde(a1, a2, (unsigned int)v6);
        return 0;
      }
      if( !MiIsPageTableDeletable((_TOKEN *)a1, (_TOKEN **)a2) )
        return 0;
      v13 = v99;
      v6 = v101;
    }
    if( (v13->Flags._bf_0 & 7) != 0 )
    {
      MiInsertTbFlushEntry((_MI_TB_FLUSH_LIST *)v14, (VOID *)v16, 1ui64, 0i64);
      if( (v15 & 0x100) == 0 && v16 >= (unsigned __int64)MmGetPteBase() && v16 <= (unsigned __int64)MmGetPteLimit() )
      {
        if( !MiEvictPageTableLock((INT64)v99, (UINT64 *)a2, v3 & 0xFFFFFFFFFFFFFBFEui64 | 0x400, v101 > 1) )
          return 0;
        goto LABEL_141;
      }
      goto LABEL_57;
    }
    PteLimit = MmGetPteLimit();
    if( v6 )
      goto LABEL_55;
    if( (v15 & 0x800) != 0 )
    {
      MiDeleteLargeUserPde(a1, a2, 0i64);
      MiFlushTbListEarly((_MI_TB_FLUSH_LIST *)v14, 0i64);
      return 0;
    }
    if( (v15 & 0x10) != 0 )
    {
      LODWORD(v18) = MiDeleteVadAwePtes(*(_QWORD *)(*(_QWORD *)(v12 + 16) + 32i64), a2, (INT64 *)(v12 + 112));
      MiInsertTbFlushEntry((_MI_TB_FLUSH_LIST *)v14, (VOID *)v16, v18, 0i64);
      goto LABEL_141;
    }
    if( (v15 & 0x60) != 0 )
    {
      MiDeletePhysmemPte(a1, a2);
      goto LABEL_141;
    }
    if( (v15 & 8) != 0 )
    {
      if( MiRotatedToFrameBuffer((_MMPTE *)a2) == 1 )
      {
        IoPageFrame = 0i64;
        MiUnmapFrameBuffer(a2, MiNotMapped, 0i64, &IoPageFrame);
        MiInsertTbFlushEntry((_MI_TB_FLUSH_LIST *)v14, (VOID *)v16, 1ui64, 0i64);
        goto LABEL_141;
      }
      v13 = v99;
      PteLimit = MmGetPteLimit();
    }
    if( (v15 & 0x90) != 0x80 )
    {
LABEL_55:
      if( (v15 & 0x100) != 0 )
      {
        MiInsertTbFlushEntry((_MI_TB_FLUSH_LIST *)v14, (VOID *)v16, 1ui64, 0i64);
LABEL_57:
        v28 = v99;
LABEL_58:
        v29 = v3 & 0xFFFFFFFFFFFFFBFEui64 | 0x400;
        v109 = v29;
        if( v101 == 3 && (v28->Flags._bf_0 & 7) != 0 )
          MiWriteTopLevelPxe(a2, v29);
        else
          *(_QWORD *)a2 = v29;
        goto LABEL_141;
      }
      v30 = 0;
      v108 = 0i64;
      if( v101
        || (PteBase = MmGetPteBase(),
            (HIBYTE(*(unsigned __int64 *)((char *)&PteBase->u.Long + ((v16 >> 9) & 0x7FFFFFFFF8i64))) & 0xF) == 8) )
      {
        PfnDb = MmGetPfnDb();
      }
      else
      {
        v32 = v12 + 120;
        v33 = (unsigned __int64 *)((char *)&PteBase->u.Long + ((v16 >> 9) & 0x7FFFFFFFF8i64));
        v34 = (wchar_t *)(unsigned __int8)(HIBYTE(*v33) & 0xF | (16 * ((*v33 >> 60) & 7)));
        v102 = HIBYTE(*v33) & 0xF | (16 * ((*v33 >> 60) & 7));
        v106 = *(_QWORD *)a2;
        LOBYTE(v35) = MI_PFN_IS_PROTO(
                        (_UNICODE_STRING *)&MmGetPfnDb()[(v106 >> 12) & 0xFFFFFFFFFi64],
                        (_UNICODE_STRING *)((v106 >> 12) & 0xFFFFFFFFFi64),
                        (UINT8)v33,
                        v34);
        v38 = v35 == 0;
        v40 = v30;
        v39 = *(_QWORD *)(v32 + 8);
        LOBYTE(v40) = v38;
        if( !v39 )
        {
LABEL_70:
          *(_QWORD *)v32 = v99;
          v42 = *(_DWORD *)(v32 + 24) & 0xFFFFFFFE;
          *(_QWORD *)(v32 + 8) = a2;
          *(_BYTE *)(v32 + 28) = v36;
          *(_DWORD *)(v32 + 24) = v40 | v42;
          *(_QWORD *)(v32 + 16) = 1i64;
          IoPageFrame = *(_QWORD *)a2;
LABEL_141:
          v77 = *(&stru_140C4DB30 + 52);
          if( (*(_BYTE *)(v14 + 4) & 2) == 0
            && *(_DWORD *)v14 == 1
            && KeGetCurrentThread()->ApcState.Process->VmContext )
          {
            v77 = -1i64;
          }
          if( (*(_DWORD *)(v14 + 12) >= *(_DWORD *)(v14 + 8) || *(_BYTE *)(v14 + 5) || *(_QWORD *)(v14 + 16) > v77)
            && v77 >= 0x400
            && !*(_BYTE *)(v14 + 5) )
          {
            MiFlushTbList((_MI_TB_FLUSH_LIST *)v14);
          }
          v12 = v104;
LABEL_152:
          if( !*(_QWORD *)v12 )
            *(_QWORD *)v12 = a2;
          *(_QWORD *)(v12 + 8) = a2;
          return 0;
        }
        v41 = *(_QWORD *)(v32 + 16);
        if( a2 == v39 + 8 * v41 && v36 == *(_BYTE *)(v32 + 28) && v40 == (*(_DWORD *)(v32 + 24) & 1) )
        {
          *(_QWORD *)(v32 + 16) = v41 + 1;
          IoPageFrame = *(_QWORD *)a2;
          goto LABEL_141;
        }
        if( (*(_DWORD *)(v32 + 24) & 2) == 0 )
        {
          MiTerminateWsleCluster(v32);
          v36 = v102;
          goto LABEL_70;
        }
      }
      v43 = MmGetPteBase();
      v44 = 1i64;
      v100 = 1;
      v45 = (volatile __int64 *)((char *)v43 + ((v16 >> 9) & 0x7FFFFFFFF8i64));
      v46 = MmGetPml4eBase();
      v47 = MmGetPxeUserLimit();
      if( v45 >= (volatile __int64 *)v46 && v45 <= (volatile __int64 *)v47 )
        LOBYTE(v46) = (unsigned __int8)MmGetPml4eBase();
      if( v16 < (unsigned __int64)v43 || v16 > (unsigned __int64)MmGetPteLimit() )
      {
        v103 = 1;
        v49 = (_UNICODE_STRING *)(HIBYTE(*v45) & 0xF);
        v50 = (unsigned __int8)((unsigned __int8)v49 | (16 * (((unsigned __int64)*v45 >> 60) & 7)));
        v48 = (_UNICODE_STRING *)&PfnDb[((unsigned __int64)*v45 >> 12) & 0xFFFFFFFFFi64];
        LOBYTE(v51) = MI_PFN_IS_PROTO(v48, v49, (UINT8)v46, &v48->Length);
        v54 = v53;
        LOBYTE(v54) = v51 == 0;
        v100 = v54;
        if( (v50 & 0xF) == 8 )
        {
          MiUnlockWsle(v99, v16, v52);
          MiGetWsleContents(v55, v16);
        }
        Long = ZeroPte.u.Long;
        v57 = *v45;
        v58 = MmGetPml4eBase();
        v59 = MmGetPxeUserLimit();
        if( (MiFlags & 0x800) != 0 )
        {
          LOBYTE(v57) = 32;
        }
        else if( (MiFlags & 0x4000000) != 0 )
        {
          _mm_lfence();
        }
        if( (v57 & 0x20) != 0 )
        {
          if( v45 >= (volatile __int64 *)v58
            && v45 <= (volatile __int64 *)v59
            && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
            && (ZeroPte.u.Long & 1) != 0 )
          {
            Long = ZeroPte.u.Long | 0x8000000000000000ui64;
          }
          *v45 = Long;
        }
        else
        {
          v60 = _InterlockedExchange64(v45, ZeroPte.u.Hard._bf_0);
          if( v45 >= (volatile __int64 *)v58 && v45 <= (volatile __int64 *)v59 )
            MiWritePteShadow();
          if( (v60 & 0x20) == 0 )
          {
LABEL_98:
            v28 = v99;
            LODWORD(v98) = v100;
            LODWORD(BugCheckParameter4) = 10;
            MiRemoveWsle((UINT64)v99, (_MMSUPPORT_INSTANCE *)v16);
            if( v103 )
            {
              v107 = *(unsigned __int64 *)((char *)&MmGetPdeBase()->u.Long + ((v16 >> 18) & 0x3FFFFFF8));
              v61 = &MmGetPfnDb()[(v107 >> 12) & 0xFFFFFFFFFi64];
              if( ((LODWORD(v61->ListEntry.Flink) >> 4) & 0x3FF) == 0 )
              {
                MiCountWslesInPageTable((INT64)&v107, v16, v113);
                v62 = 8;
                while( 1 )
                {
                  v63 = *((_DWORD *)v113 + (unsigned __int8)--v62);
                  if( v63 )
                    break;
                  if( !v62 )
                    goto LABEL_105;
                }
                v61->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = v61->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 & 0xFFFFFFFFFFFE000Fui64 | (16 * (v63 & 0x3FF | ((unsigned __int64)(v62 & 7) << 10)));
              }
            }
LABEL_105:
            if( (_DWORD)v108 != 1 )
              goto LABEL_58;
            if( *(_DWORD *)v14 != 1 )
            {
              v64 = *(_BYTE *)(v14 + 4);
              if( (v64 & 8) == 0 && v16 >= (unsigned __int64)MmGetPteBase() && v16 <= (unsigned __int64)MmGetPteLimit() )
                *(_BYTE *)(v14 + 4) = v64 | 8;
            }
            v65 = *(_DWORD *)(v14 + 12);
            v66 = *(_BYTE *)(v14 + 4);
            if( v65 )
            {
              if( (v66 & 4) == 0 )
              {
                v67 = v14 + 8i64 * (v65 - 1);
                v68 = *(_QWORD *)(v67 + 24);
                if( (v68 & 0xC00) == 0 )
                {
                  v69 = *(_QWORD *)(v67 + 24) & 0x3FFi64;
                  if( (v68 & 0xFFFFFFFFFFFFF000ui64) + ((v69 + 1) << 12) == v16 && v69 + 1 > v69 && v69 + 1 <= 0x3FF )
                  {
                    ++*(_QWORD *)(v14 + 16);
                    *(_QWORD *)(v67 + 24) = v68 ^ ((unsigned __int16)v68 ^ (unsigned __int16)(v68 + 1)) & 0x3FF;
                    goto LABEL_58;
                  }
                }
              }
              if( (v66 & 4) == 0 )
              {
                v70 = v14 + 8i64 * (v65 - 1);
                v71 = *(_QWORD *)(v70 + 24);
                if( (v71 & 0xC00) == 0 && (v71 & 0xFFFFFFFFFFFFF000ui64) == v16 + 4096 )
                {
                  v72 = *(_QWORD *)(v70 + 24) & 0x3FFi64;
                  if( v72 + 1 > v72 && v72 + 1 <= 0x3FF )
                  {
                    ++*(_QWORD *)(v14 + 16);
                    *(_QWORD *)(v70 + 24) = (v71 - 4096) ^ ((unsigned __int16)(v71 - 4096) ^ (unsigned __int16)(v71 - 4096 + 1)) & 0x3FF;
                    goto LABEL_58;
                  }
                }
              }
            }
            if( v65 < *(_DWORD *)(v14 + 8) )
            {
              while( 1 )
              {
                v73 = 1024i64;
                if( (unsigned __int64)(v44 - 1) <= 0x3FF )
                  v73 = v44;
                v44 -= v73;
                v74 = v16 & 0xFFFFFFFFFFFFF000ui64 | ((_WORD)v73 - 1) & 0x3FF;
                v16 += v73 << 12;
                *(_QWORD *)(v14 + 8i64 * (unsigned int)(*(_DWORD *)(v14 + 12))++ + 24) = v74;
                v75 = *(_DWORD *)(v14 + 12);
                *(_QWORD *)(v14 + 16) += v73;
                if( v75 == *(_DWORD *)(v14 + 8) && (*(_BYTE *)(v14 + 4) & 4) == 0 )
                {
                  qsort(v14 + 24, v75, 8ui64, (INT64)MiTbFlushSort, BugCheckParameter4, v98, (UINT64)v99);
                  MiCompressTbFlushList((_MI_TB_FLUSH_LIST *)v14);
                  v76 = *(unsigned int *)(v14 + 12);
                  if( (_DWORD)v76 == *(_DWORD *)(v14 + 8) )
                    break;
                }
                if( !v44 )
                  goto LABEL_58;
              }
              if( v44 )
              {
                *(_BYTE *)(v14 + 5) = 1;
                *(_QWORD *)(v14 + 16) = v76;
              }
            }
            else
            {
              *(_BYTE *)(v14 + 5) = 1;
            }
            goto LABEL_58;
          }
        }
      }
      else
      {
        v103 = v30;
        if( !MiEvictPageTableLock((INT64)v99, (UINT64 *)v45, ZeroPte.u.Hard._bf_0, 0) )
          return 0;
      }
      LODWORD(v108) = 1;
      goto LABEL_98;
    }
    if( (v15 & 2) != 0 && (v13->Flags._bf_0 & 1) == 0 && *(&stru_140C4DB30 + 654) )
    {
      v19 = MmGetPteBase();
      if( v16 >= (unsigned __int64)v19 && v16 <= (unsigned __int64)PteLimit )
      {
LABEL_42:
        if( (*(_BYTE *)a2 & 0x20) != 0 )
          MiLogPageAccess(v13, (_MMPTE *)a2);
        goto LABEL_44;
      }
      if( (HIBYTE(*(unsigned __int64 *)((char *)&v19->u.Long + ((v16 >> 9) & 0x7FFFFFFFF8i64))) & 0xF) != 7 )
      {
        v13 = v99;
        goto LABEL_42;
      }
    }
LABEL_44:
    MiPteInShadowRange((UINT64)&v109);
    v23 = &MmGetPfnDb()[(v3 >> 12) & 0xFFFFFFFFFi64];
    if( (v23->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) == 1 )
    {
      if( (v15 & 1) != 0 && (unsigned int)(MiGetPfnPriority(v23) - 3) <= 2 )
        MiLockSetPfnPriority(v24, (VOID *)2);
      if( (v15 & 4) != 0 && !*(_QWORD *)(v12 + 88) && (v3 & 0x42) == 0 )
      {
        LOBYTE(v25) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v23, v20, v21, v22);
        if( v25 )
        {
          if( (*(_BYTE *)(&v23->u3 + 1) & 0x10) == 0 && (unsigned int)MiGetPfnPriority(v26) < 5 )
            *(_QWORD *)(v12 + 88) = MiCreateDecayPfn(v27);
        }
      }
    }
    goto LABEL_55;
  }
  if( (v3 & 0x400) != 0 )
  {
    v79 = v3;
    if( *(&stru_140C4DB30 + 42) && (v3 & 0x10) == 0 )
      v79 = v3 & ~*(&stru_140C4DB30 + 42);
    if( HIDWORD(v79) == 0xFFFFFFFF || (v3 & 0x800) == 0 )
    {
      if( !KeGetCurrentThread()->ApcState.Process->CloneRoot.Root )
        goto LABEL_172;
      LOBYTE(v81) = MiIsPrototypePteVadLookup(v3);
      if( v81 )
        goto LABEL_172;
      CloneAddress = MiLocateCloneAddress(v83, v82);
      if( !CloneAddress )
        goto LABEL_172;
      v80 = MiDecrementCloneBlockReference((ULONG_PTR)CloneAddress, v85, v86);
    }
    else
    {
      v80 = MiDecrementCombinedPte((_MMPTE *)v13);
    }
    if( v80 == PageStillReferenced )
    {
      ++*(_QWORD *)(*(_QWORD *)(v12 + 16) + 8i64);
    }
    else if( v80 == PageCommitNotCharged )
    {
      ++*(_QWORD *)(*(_QWORD *)(v12 + 16) + 16i64);
    }
    PxeUserLimit = MmGetPxeUserLimit();
LABEL_172:
    v87.Long = ZeroPte.u.Long;
    v88 = MmGetPml4eBase();
    if( a2 >= (unsigned __int64)v88 )
    {
      v89 = PxeUserLimit;
LABEL_193:
      if( a2 <= (unsigned __int64)v89
        && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
        && (v87.Long & 1) != 0 )
      {
        v87.Long |= 0x8000000000000000ui64;
      }
      goto LABEL_197;
    }
    goto LABEL_197;
  }
  if( (v3 & 0x800) != 0 )
  {
    if( (v15 & 0x800) != 0 )
      goto LABEL_19;
    if( (v15 & 0x10) != 0 && (v3 & 0x3E0) == 768 )
      MiDeleteVadAwePtes(*(_QWORD *)(*(_QWORD *)(v12 + 16) + 32i64), a2, (INT64 *)(v12 + 112));
    goto LABEL_152;
  }
  if( (v3 & 0x3E0) == 0 )
    KeBugCheckEx(0x1Au, (PVOID)0x41792, (PVOID)a2, (PVOID)v3, 0i64);
  PartitionId = v13->PartitionId;
  v110 = v3;
  v91 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * PartitionId);
  if( (v3 & 4) != 0 || (v3 & 2) != 0 )
    LODWORD(v92) = MI_READ_PTE_LOCK_FREE((INT64)&v110);
  else
    v92 = 0i64;
  v110 = v92;
  if( v92 )
    MiReleasePageFileInfo(v91, (_MMPTE)v92, 0i64);
  if( (v99->Flags._bf_0 & 7) != 0 )
    goto LABEL_190;
  if( (v15 & 0x80u) != 0 )
  {
    if( *(&stru_140C4DB30 + 42) && (v3 & 0x10) == 0 )
      LOWORD(v3) = ~*(&stru_140C4DB30 + 168) & v3;
    if( (v3 & 0x400) != 0 || (v3 & 0x800) != 0 || (v3 & 4) != 0 )
LABEL_190:
      ++*(_QWORD *)(*(_QWORD *)(v12 + 16) + 24i64);
  }
  v87.Long = ZeroPte.u.Long;
  v88 = MmGetPml4eBase();
  if( a2 >= (unsigned __int64)v88 )
  {
    v89 = MmGetPxeUserLimit();
    goto LABEL_193;
  }
LABEL_197:
  *(union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} *)a2 = (union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;})v87.Long;
  if( (v15 & 0x80u) != 0 && (a2 < (unsigned __int64)v88 || a2 > (unsigned __int64)MmGetPml4eLimit()) )
  {
    v93 = (__int64 *)((char *)MmGetPdeBase() + ((v16 >> 18) & 0x3FFFFFF8));
    PteShadow = *v93;
    v95 = MmGetPxeUserLimit();
    if( v93 >= (__int64 *)v88 && v93 <= (__int64 *)v95 )
    {
      PteShadow = MiReadPteShadow((__int64)v93, *v93);
      v95 = MmGetPxeUserLimit();
    }
    v111 = PteShadow;
    if( &v111 >= (unsigned __int64 *)v88 && &v111 <= (unsigned __int64 *)v95 )
      PteShadow = MiReadPteShadow((__int64)&v111, PteShadow);
    v96 = &MmGetPfnDb()[(PteShadow >> 12) & 0xFFFFFFFFFi64];
    if( (*(_DWORD *)(&v96->3 + 1) & 0x3FF0000) == 0 )
      KeBugCheckEx(0x1Au, (PVOID)0x41790, v96, (PVOID)(HIWORD(*((_DWORD *)&v96->3 + 4)) & 0x3FF), (PVOID)1);
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)&v96->u2, 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( v96->u2._bf_0 < 0 );
    }
    v96->OriginalPte.u.Long ^= ((unsigned int)v96->OriginalPte.u.Long ^ (((unsigned int)(v96->OriginalPte.u.Long >> 16)
                                                                        - 1) << 16)) & 0x3FF0000;
    _InterlockedAnd64(&v96->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  }
  return 0;
}

Referenced by: