MiRemoveSystemImagePage

NTSTATUS __stdcall MiRemoveSystemImagePage(INT64 a1, INT64 a2, INT64 a3){
  unsigned __int64 v4; 
  volatile signed __int32 *v5; 
  __int64 v6; 
  UINT64 LogAccess; 
  UINT64 SpinCount; 

  LODWORD(LogAccess) = 0;
  *(_BYTE *)(a3 + 35) |= 8u;
  _InterlockedAnd64((volatile signed __int64 *)(a3 + 24), 0x7FFFFFFFFFFFFFFFui64);
  v4 = ((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  if( PsNtosImageBase
    && (v4 < PsNtosImageEnd && v4 >= PsNtosImageBase || v4 < PsHalImageEnd && v4 >= (unsigned __int64)PsHalImageBase) )
  {
    v5 = (volatile signed __int32 *)&xmmword_140C4CA88 + 2;
  }
  else
  {
    v5 = (volatile signed __int32 *)&xmmword_140C4CA88 + 3;
  }
  _InterlockedDecrement(v5);
  MiTerminateWsle((VOID *)a1, (_MMSUPPORT_INSTANCE *)v4, 2ui64, (UINT64)&LogAccess);
  LODWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)(a3 + 24), 0x3Fui64) )
  {
    do
    {
      KeYieldProcessorEx(&SpinCount);
      v6 = *(_QWORD *)(a3 + 24);
    }
    while( v6 < 0 );
  }
  return v6;
}

Referenced by: