MiQueryAddressState

NTSTATUS __stdcall MiQueryAddressState(
        VOID *Va,
        UINT8 WsIrql,
        _MMVAD_SHORT *Vad,
        _EPROCESS *TargetProcess,
        UINT64 PageTableFlags,
        VOID **VaWithProto,
        UINT64 *ReturnedProtect,
        VOID **NextVaToQuery){
  unsigned __int64 v8; 
  unsigned __int8 v9; 
  _MMSUPPORT_FULL *p_Vm; 
  unsigned __int64 v11; 
  __int64 PartitionId; 
  _MMPTE *PteBase; 
  __int64 v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  __int64 v17; 
  _BOOL4 v18; 
  _MMPTE *v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  _MMPTE *PteLimit; 
  _MMSUPPORT_FULL *AnyMultiplexedVm; 
  NTSTATUS v24; 
  unsigned int v25; 
  INT64 DpcRequestSummary; 
  unsigned __int64 v27; 
  UINT64 v28; 
  unsigned __int64 v29; 
  __int64 v30; 
  unsigned __int64 v31; 
  int v32; 
  int v33; 
  unsigned int v34; 
  _MMPTE *Pml4eBase; 
  UINT64 v36; 
  int v37; 
  NTSTATUS PageProtection; 
  UINT64 v39; 
  __int64 v40; 
  unsigned int v41; 
  INT64 v42; 
  int *v43; 
  UINT64 *v44; 
  __int64 ********LockedVadEvent; 
  INT16 **v46; 
  INT64 v47; 
  unsigned __int64 v48; 
  UINT64 v49; 
  int v50; 
  INT64 v51; 
  unsigned __int64 v52; 
  int v53; 
  INT64 v54; 
  INT64 v55; 
  unsigned __int64 v56; 
  __int64 v57; 
  unsigned __int64 v58; 
  unsigned __int64 v59; 
  _QWORD *v60; 
  _QWORD *v61; 
  int v62; 
  unsigned __int64 v63; 
  unsigned __int64 v64; 
  INT64 v65; 
  unsigned __int64 v66; 
  __int64 v67; 
  __int64 v68; 
  __int64 v69; 
  _RTL_BALANCED_NODE *v70; 
  _CONTROL_AREA *v71; 
  unsigned int SessionId; 
  _RTL_BALANCED_NODE *SharedProtos; 
  unsigned __int64 v74; 
  __int64 v75; 
  __int64 v76; 
  unsigned __int64 v77; 
  unsigned __int64 v78; 
  int v79; 
  __int16 v80; 
  __int64 v81; 
  unsigned __int64 v82; 
  unsigned __int64 v83; 
  unsigned __int64 v84; 
  INT16 *v85; 
  char v86; 
  struct _KPRCB *CurrentPrcb; 
  bool v88; 
  _KSPIN_LOCK_QUEUE *volatile Next; 
  _MMPTE *Pml4eLimit; 
  _MMPTE *NextPteToAge; 
  int v92; 
  char *PageTableLockBuffer; 
  _DWORD *v94; 
  struct _KPRCB *v95; 
  int v96; 
  int v97; 
  _ETHREAD *NextThread; 
  _MMSUPPORT_INSTANCE *v99; 
  UINT64 v100; 
  unsigned __int64 v101; 
  __int16 v102; 
  unsigned int v103; 
  NTSTATUS ProtectionFromPte; 
  __int64 v105; 
  NTSTATUS result; 
  VOID **v107; 
  int v108; 
  INT16 *v109; 
  unsigned __int8 v110; 
  INT16 v111; 
  int v112; 
  int v113; 
  INT64 v114; 
  INT64 v115; 
  INT16 v116; 
  _DWORD WsExclusive[3]; 
  UINT64 v118; 
  PVOID Vada; 
  int v120; 
  UINT64 v121; 
  unsigned int v122; 
  int v123; 
  INT64 v124; 
  unsigned int v125; 
  int v126; 
  unsigned __int64 v127; 
  unsigned __int64 v128; 
  __int64 v129; 
  __int64 *v130; 
  VOID **v131; 
  UINT64 *v132; 
  VOID **v133; 
  __int128 v134; 
  __int64 v135; 
  int *v136; 
  __int64 v137; 
  _QWORD v138[22]; 
  __int64 *v139; 
  int *v140; 

  v8 = (unsigned __int64)Va;
  v131 = VaWithProto;
  v9 = (unsigned __int8)Vad;
  v132 = ReturnedProtect;
  v133 = NextVaToQuery;
  v130 = v139;
  v110 = (unsigned __int8)Vad;
  Vada = TargetProcess;
  p_Vm = &KeGetCurrentThread()->ApcState.Process->Vm;
  v136 = v140;
  v114 = (INT64)p_Vm;
  v11 = (unsigned __int64)Va >> 9;
  *(_QWORD *)&WsExclusive[1] = 0i64;
  PartitionId = p_Vm->Instance.PartitionId;
  v124 = 0i64;
  LOWORD(p_Vm) = **(_WORD **)(*(&stru_140C4DB30 + 267) + 8 * PartitionId);
  *v140 = 1;
  v116 = (__int16)p_Vm;
  v111 = (__int16)p_Vm;
  PteBase = MmGetPteBase();
  v14 = (__int64)PteBase + (v11 & 0x7FFFFFFFF8i64);
  v137 = v14;
  v15 = (unsigned __int64)PteBase + ((WsIrql >> 9) & 0x7FFFFFFFF8i64);
  v115 = v14;
  v128 = v15;
  v125 = 0x2000;
  v16 = 0i64;
  v122 = 0;
  v123 = 0;
  v121 = 0i64;
  v17 = (_QWORD)PteBase << 25;
  v129 = (_QWORD)PteBase << 25;
  v135 = (__int64)((v15 << 25) - ((_QWORD)PteBase << 25)) >> 16;
LABEL_2:
  v127 = v15;
  v120 = 0;
  v118 = 0i64;
  v18 = 0;
  v134 = 0i64;
  memset((char *)v138 + 2, 0i64, 0xAEu);
  v19 = MmGetPteBase();
  LOWORD(v138[0]) = 2145;
  v20 = ((v14 << 25) - v17) >> 16;
  v21 = v20;
  if( v20 >= (unsigned __int64)v19 )
  {
    PteLimit = MmGetPteLimit();
    do
    {
      if( v21 > (unsigned __int64)PteLimit )
        break;
      v21 = (__int64)((v21 << 25) - v17) >> 16;
    }
    while( v21 >= (unsigned __int64)v19 );
    v9 = v110;
  }
  if( v21 < 0xFFFF800000000000ui64 || v21 >= *(&stru_140C4DB30 + 937) && v21 <= *(&stru_140C4DB30 + 175) )
    AnyMultiplexedVm = &KeGetCurrentThread()->ApcState.Process->Vm;
  else
    AnyMultiplexedVm = (_MMSUPPORT_FULL *)MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v19);
  v24 = MiFastLockLeafPageTable((INT64)AnyMultiplexedVm, v20);
  if( v24 )
  {
    v25 = v24 - 1;
    LODWORD(v134) = v24 - 1;
    DpcRequestSummary = (INT64)MmGetPteBase();
    v27 = DpcRequestSummary + ((v20 >> 9) & 0x7FFFFFFFF8i64);
    *((_QWORD *)&v134 + 1) = v27;
  }
  else
  {
    LOWORD(v138[0]) |= 4u;
    v138[21] = &v134;
    v138[2] = 0i64;
    v138[3] = AnyMultiplexedVm;
    BYTE2(v138[0]) = BYTE2(v138[0]) & 0xE3 | 4;
    v138[20] = MiGetNextPageTableTail;
    v138[5] = v135;
    BYTE6(v138[0]) = v9;
    v138[4] = v20;
    MiWalkPageTables((INT64)v138);
    v25 = v134;
    v27 = *((_QWORD *)&v134 + 1);
    DpcRequestSummary = (INT64)MmGetPteBase();
  }
  if( v27 )
  {
    v28 = DpcRequestSummary + ((v27 >> 9) & 0x7FFFFFFFF8i64);
    v121 = v28;
    if( v25 )
    {
      v29 = DpcRequestSummary + ((v27 >> 9) & 0x7FFFFFFFF8i64);
      if( v25 > 1 )
      {
        v30 = v25 - 1;
        do
        {
          v29 = DpcRequestSummary + ((v29 >> 9) & 0x7FFFFFFFF8i64);
          --v30;
        }
        while( v30 );
      }
      v28 = DpcRequestSummary + ((v29 >> 9) & 0x7FFFFFFFF8i64);
      if( v27 == v14 )
      {
        LODWORD(v100) = MI_READ_PTE_LOCK_FREE(v29);
        v118 = v100;
        v101 = v100;
        if( (v100 & 1) != 0 )
        {
          MiPteInShadowRange((UINT64)&v118);
        }
        else if( *(&stru_140C4DB30 + 42) )
        {
          if( (v100 & 0x10) != 0 )
            v101 = v100 & 0xFFFFFFFFFFFFFFEFui64;
          else
            v101 = ~*(&stru_140C4DB30 + 42) & v100;
        }
        v102 = ((unsigned __int64)MmGetPfnDb()[(v101 >> 12) & 0xFFFFFFFFFi64].u4._bf_0 >> 39) & 0x3FF;
        v103 = *((_DWORD *)Vada + 12);
        if( (*((_BYTE *)Vada + 48) & 0x70) == 48 || (v103 & 0x500000) == 5242880 )
          ProtectionFromPte = MiGetProtectionFromPte(Vada, (PVOID)v118);
        else
          ProtectionFromPte = (v103 >> 7) & 0x1F;
        *(_DWORD *)v131 = ProtectionFromPte;
        MiUnlockPageTableInternal(v114, v28);
        *(_DWORD *)v132 = 0;
        *(_WORD *)v133 = v102;
        LODWORD(v105) = MiGetLeafVa(v29 + 8);
        *v130 = v105;
        return 4096;
      }
    }
    else if( v14 == v27 )
    {
      LODWORD(v36) = MI_READ_PTE_LOCK_FREE(v14);
      v118 = v36;
      v120 = 1;
      v27 = v14 + 8;
      v31 = (v14 & 0xFFFFFFFFFFFFF000ui64) + 4088;
      v18 = v36 == 0;
      goto LABEL_23;
    }
    MiUnlockPageTableInternal(v114, v28);
    v121 = 0i64;
    v31 = (v27 & 0xFFFFFFFFFFFFF000ui64) - 8;
LABEL_23:
    if( v31 > v128 )
      v31 = v128;
    v127 = v31;
    goto LABEL_26;
  }
  v27 = v128 + 8;
LABEL_26:
  v32 = 0;
  while( 1 )
  {
    v33 = v32;
    v113 = v32;
    v34 = 0x2000;
    WsExclusive[0] = v32;
    v112 = v32;
    if( !v118 )
    {
      v43 = (int *)Vada;
      *v136 = v32;
      v44 = (UINT64 *)(unsigned int)v43[12];
      if( (v43[12] & 0x70) == 48 || ((unsigned __int8)v44 & 0x70) == 16 )
      {
        if( ((unsigned __int8)v44 & 0x70) == 48 )
        {
          LODWORD(v85) = MiGetAweVadPartition((INT64)v43);
          v111 = *v85;
        }
LABEL_59:
        v41 = v33;
LABEL_60:
        v42 = PageTableFlags;
        goto LABEL_61;
      }
      if( ((unsigned int)v44 & 0x100000) != 0 )
      {
        if( v43[13] >= 0 )
        {
          v41 = v32;
        }
        else
        {
          v34 = 4096;
          v41 = ((unsigned int)v44 >> 7) & 0x1F;
          WsExclusive[0] = MI_GET_GRAPHICS_PROTECTION_FROM_VAD((INT64)v43, 0i64, DpcRequestSummary, v44, (CHAR)v109);
        }
        if( ((unsigned int)v44 & 0x500000) == 5242880 )
        {
          LockedVadEvent = MiLocateLockedVadEvent((__int64)v43, 16);
          if( LockedVadEvent )
          {
            if( LockedVadEvent[3] && PsReferencePartitionSafe((INT64)LockedVadEvent[3]) )
            {
              v111 = **v46;
              PsDereferencePartition((INT64)v46);
              v32 = 0;
            }
          }
        }
        goto LABEL_60;
      }
      v47 = v8 >> 12;
      v111 = **(_WORD **)(*(&stru_140C4DB30 + 267) + 8i64 * (*(_WORD *)(**((_QWORD **)v43 + 9) + 60i64) & 0x3FF));
      MiGetProtoPteAddress();
      *(_QWORD *)&WsExclusive[1] = v48;
      v49 = v48;
      if( !v48 )
      {
        if( PageTableFlags )
        {
          LOBYTE(v50) = MiQueryStateMatches(PageTableFlags, 0x2000i64, 0i64, 0i64, 0);
          if( !v50 )
          {
            v14 = v115;
            v33 = 1;
            v41 = v113;
            v27 = v115;
            v112 = 1;
LABEL_61:
            v40 = v114;
LABEL_62:
            Pml4eBase = MmGetPml4eBase();
            goto LABEL_63;
          }
        }
        if( MiVadPureReserve((_MMVAD_SHORT *)Vada) && v124 && !*(_QWORD *)(v124 + 8) )
        {
          v14 = v115;
          LODWORD(v52) = MiSkipEntirePagefileRegions(v51, v47, v115, v27, v124);
          v40 = v114;
          v32 = 0;
          v42 = PageTableFlags;
          v27 = v52;
          Pml4eBase = MmGetPml4eBase();
          v41 = v33;
          if( v52 == v14 )
            v27 = v14 + 8;
          goto LABEL_63;
        }
        v14 = v115;
        v27 = v115 + 8;
        goto LABEL_59;
      }
      v54 = v124;
      if( v18 )
      {
        v55 = v115;
        v56 = *(_QWORD *)(v124 + 8);
        v57 = ((__int64)(v127 - v115) >> 3) + 1;
        if( v57 > 32 )
          v57 = 32i64;
        v58 = v56 + 8 * (*(unsigned int *)(v124 + 44) - (unsigned __int64)(*(_DWORD *)(v124 + 52) & 0x3FFFFFFF));
        if( (*(_BYTE *)(v124 + 34) & 2) != 0 || v48 < v56 || v48 >= v58 )
        {
          v57 = 0i64;
        }
        else if( v48 + 8 * v57 > v58 )
        {
          v57 = (__int64)(v58 - v48) >> 3;
        }
        v59 = v115 - 8 + 8 * v57;
        v27 = v115 + 8;
        if( v115 + 8 <= v59 )
        {
          do
          {
            if( *(_QWORD *)v27 )
              break;
            v27 += 8i64;
          }
          while( v27 <= v59 );
          v49 = *(_QWORD *)&WsExclusive[1];
          v54 = v124;
          v55 = v115;
        }
        if( v120 )
          goto LABEL_81;
      }
      else
      {
        if( v120 )
        {
LABEL_81:
          v60 = Vada;
          goto LABEL_82;
        }
        v55 = v115;
        v64 = *(_QWORD *)(v124 + 8);
        v65 = (__int64)(v27 - v115) >> 3;
        v66 = v64 + 8 * (*(unsigned int *)(v124 + 44) - (unsigned __int64)(*(_DWORD *)(v124 + 52) & 0x3FFFFFFF));
        if( (*(_BYTE *)(v124 + 34) & 2) != 0 || v48 < v64 || v48 >= v66 )
        {
          v65 = 1i64;
        }
        else if( v48 + 8 * v65 > v66 )
        {
          v65 = (__int64)(v66 - v48) >> 3;
        }
        v27 = v115 + 8 * v65;
      }
      if( MiVadPureReserve((_MMVAD_SHORT *)Vada) )
      {
        LODWORD(v67) = MiSkipFractionalPagefileRegion(v49, v54, (__int64)(v27 - v55) >> 3);
        v60 = Vada;
        if( v67 != v49 )
        {
          v68 = (__int64)(v67 - v49) >> 3;
          v32 = 0;
          v49 = 0i64;
          *(_QWORD *)&WsExclusive[1] = 0i64;
          v27 = v55 + 8 * v68;
LABEL_83:
          v61 = (_QWORD *)v60[15];
          if( (__int64)v61 >= 0 )
          {
            v62 = 0;
            v63 = -1i64;
          }
          else
          {
            v62 = 1;
            v63 = (unsigned __int64)(*v61 - 1i64) >> 12;
          }
          if( v49 )
          {
            if( (v60[6] & 0x70) == 32 )
            {
              v69 = v60[9];
              v32 = 0;
              v70 = 0i64;
              if( v69 )
              {
                do
                {
                  if( (*(_BYTE *)(v69 + 34) & 2) != 0
                    && (v71 = *(_CONTROL_AREA **)v69, (*(_DWORD *)(*(_QWORD *)v69 + 56i64) & 0x4000000) != 0) )
                  {
                    SessionId = MmGetSessionIdEx(KeGetCurrentThread()->ApcState.Process);
                    SharedProtos = MiGetSharedProtos(v71, SessionId, (_SUBSECTION *)v69);
                    v49 = *(_QWORD *)&WsExclusive[1];
                    v70 = SharedProtos[3].Children[0];
                  }
                  else
                  {
                    v70 = *(_RTL_BALANCED_NODE **)(v69 + 8);
                  }
                  if( v49 >= (unsigned __int64)v70 && v49 < (unsigned __int64)v70 + 8 * *(unsigned int *)(v69 + 44) )
                    break;
                  v69 = *(_QWORD *)(v69 + 16);
                }
                while( v69 );
                v60 = Vada;
                v32 = 0;
              }
              if( (__int64)(v49 - (_QWORD)v70) >> 3 < (unsigned __int64)(*(_DWORD *)(v69 + 44)
                                                                        - (*(_DWORD *)(v69 + 52) & 0x3FFFFFFFu)) )
              {
                v41 = (*((_DWORD *)v60 + 12) >> 7) & 0x1F;
                if( v41 == 7 )
                  v41 = (*(unsigned __int16 *)(v69 + 32) >> 1) & 0x1F;
                v14 = v115;
                v33 = v112;
                v40 = v114;
                v42 = PageTableFlags;
                Pml4eBase = MmGetPml4eBase();
                if( v41 )
                  v34 = 4096;
                goto LABEL_63;
              }
              v14 = v115;
              v41 = 0;
              v33 = v112;
            }
            else
            {
              if( !*(_QWORD *)(*(_QWORD *)v54 + 64i64) && (*(_DWORD *)(*(_QWORD *)v54 + 56i64) & 0x2000) == 0 )
              {
                if( v121 )
                {
                  MiUnlockPageTableInternal(v114, v121);
                  v121 = 0i64;
                }
                MiUnlockWorkingSetShared((_MMSUPPORT_INSTANCE *)v114, v110);
                v74 = *(unsigned int *)(v54 + 44) - (unsigned __int64)(*(_DWORD *)(v54 + 52) & 0x3FFFFFFF);
                v75 = *(_QWORD *)(v54 + 8);
                v76 = *(_QWORD *)v49;
                v77 = (__int64)(v27 - v115) >> 3;
                v78 = (__int64)(v75 + 8 * v74 - v49) >> 3;
                if( v78 > v77 )
                  v78 = v77;
                MiPteInShadowRange(v49);
                if( v76 )
                {
                  v34 = 4096;
                  v41 = (*((_DWORD *)Vada + 12) >> 7) & 0x1F;
                }
                else
                {
                  v41 = v113;
                }
                if( !PageTableFlags || (LOBYTE(v79) = MiQueryStateMatches(PageTableFlags, v34, v41, 0i64, v111), v79) )
                {
                  if( v78 )
                  {
                    while( 1 )
                    {
LABEL_127:
                      if( *(_QWORD *)v49 )
                      {
                        if( v34 != 4096 )
                          break;
                      }
                      else if( v34 == 4096 )
                      {
                        break;
                      }
                      v49 += 8i64;
                      ++v16;
                      *(_QWORD *)&WsExclusive[1] = v49;
                      if( !--v78 )
                        break;
                      while( (v49 & 0xFFF) == 0 )
                      {
                        v80 = MI_READ_PTE_LOCK_FREE((INT64)MmGetPteBase() + ((v49 >> 9) & 0x7FFFFFFFF8i64));
                        if( (v80 & 1) != 0 || (v80 & 0x3E0) != 0 )
                        {
                          if( v34 == 4096 )
                            goto LABEL_127;
                          goto LABEL_142;
                        }
                        if( v34 == 4096 )
                          goto LABEL_142;
                        if( v78 <= 0x200 )
                        {
                          v16 += v78;
                          *(_QWORD *)&WsExclusive[1] = v49 + 8 * v78;
                          goto LABEL_142;
                        }
                        v49 += 4096i64;
                        v16 += 512i64;
                        *(_QWORD *)&WsExclusive[1] = v49;
                        v78 -= 512i64;
                        if( !v78 )
                          goto LABEL_142;
                      }
                    }
                  }
LABEL_142:
                  v33 = v112;
                }
                else
                {
                  v33 = 1;
                  v112 = 1;
                  v16 = 0i64;
                }
                v14 = v115;
                v40 = v114;
                v27 = v115 + 8 * v16;
                MiLockWorkingSetShared();
                v42 = PageTableFlags;
                v32 = 0;
                goto LABEL_62;
              }
              v81 = *(_QWORD *)(v54 + 8)
                  + 8 * (*(unsigned int *)(v54 + 44) - (unsigned __int64)(*(_DWORD *)(v54 + 52) & 0x3FFFFFFF))
                  - v49;
              v14 = v115;
              v16 = v81 >> 3;
              v82 = (__int64)(v27 - v115) >> 3;
              if( v16 > v82 )
                v16 = v82;
              v83 = v16;
              if( v62 )
              {
                v84 = *((unsigned int *)v60 + 6) | ((unsigned __int64)*((unsigned __int8 *)v60 + 32) << 32);
                if( v47 - v84 <= v63 )
                {
                  v16 = v84 - v47 + v63 + 1;
                  v62 = 0;
                  if( v83 <= v16 )
                    v16 = v83;
                }
              }
              v27 = v115 + 8 * v16;
              if( v62 )
                v41 = v113;
              else
                v41 = (*((_DWORD *)v60 + 12) >> 7) & 0x1F;
              v33 = v112;
              v34 = 4096;
              if( v62 )
                v34 = 0x2000;
              v32 = 0;
            }
          }
          else
          {
            v41 = v113;
            v33 = v113;
            v14 = v115;
          }
          goto LABEL_60;
        }
      }
LABEL_82:
      v32 = 0;
      goto LABEL_83;
    }
    Pml4eBase = MmGetPml4eBase();
    if( (v118 & 0x3E0) == 512
      && (v118 & 1) == 0
      && ((v118 & 0x400) == 0 || (LOBYTE(v37) = MiIsPrototypePteVadLookup(v118), v37)) )
    {
      v40 = v114;
      v41 = v33;
      v42 = PageTableFlags;
    }
    else
    {
      v109 = &v111;
      v34 = 4096;
      PageProtection = MiGetPageProtection(Vada, (PVOID)v14, (UINT8)&WsExclusive[1], (UINT64)WsExclusive);
      v39 = *(_QWORD *)&WsExclusive[1];
      if( *(_QWORD *)&WsExclusive[1] )
      {
        v99 = (_MMSUPPORT_INSTANCE *)v114;
        MiUnlockPageTableInternal(v114, v121);
        v121 = 0i64;
        MiUnlockWorkingSetShared(v99, v110);
        MiFaultInPagedPool(v39);
        MiLockWorkingSetShared();
        v15 = v128;
        v17 = v129;
        v9 = v110;
        goto LABEL_2;
      }
      v33 = v112;
      v32 = 0;
      v40 = v114;
      v41 = PageProtection;
      v42 = PageTableFlags;
      Pml4eBase = MmGetPml4eBase();
      if( !PageProtection )
        v34 = 0x2000;
    }
LABEL_63:
    DpcRequestSummary = v137;
    if( v14 == v137 )
    {
      v116 = v111;
      v125 = v34;
      v122 = v41;
      v123 = WsExclusive[0];
      if( v42 )
      {
        LOBYTE(v53) = MiQueryStateMatches(v42, v34, v41, WsExclusive[0], v111);
        if( !v53 )
          goto LABEL_236;
      }
      goto LABEL_214;
    }
    if( v34 != v125 || v111 != v116 || v41 != v122 || WsExclusive[0] != v123 )
      break;
    if( v16 || v33 == 1 || (__int64)((v14 - v137) & 0xFFFFFFFFFFFFFFF8ui64) < 256 )
      goto LABEL_214;
    if( !v121 )
      goto LABEL_190;
    v86 = *(_BYTE *)(v40 + 184) & 7;
    v126 = v32;
    if( (_MMPTE *)v121 != MmGetPxeSelfRef() )
    {
      if( v86 )
        goto LABEL_182;
      Pml4eLimit = MmGetPml4eLimit();
      if( v121 >= (unsigned __int64)Pml4eBase && v121 <= (unsigned __int64)Pml4eLimit )
      {
        NextPteToAge = KeGetCurrentThread()->ApcState.Process->Vm.Instance.VmWorkingSetList[15].NextPteToAge;
        if( NextPteToAge )
        {
          v92 = (*((_DWORD *)&NextPteToAge->u.Long + (((unsigned int)v121 >> 3) & 0x1FF)) >> 30) & 1;
LABEL_188:
          v88 = v92 == 0;
          goto LABEL_189;
        }
LABEL_182:
        Pml4eLimit = MmGetPml4eLimit();
      }
      if( v86 && v121 >= (unsigned __int64)Pml4eBase && v121 <= (unsigned __int64)Pml4eLimit )
      {
        PageTableLockBuffer = MiGetPageTableLockBuffer(v40, v121, &v126);
        v88 = ((*(_DWORD *)PageTableLockBuffer >> v126) & 2) == 0;
        goto LABEL_189;
      }
      v92 = (*(_QWORD *)v121 >> 60) & 2;
      goto LABEL_188;
    }
    CurrentPrcb = KeGetCurrentPrcb();
    if( v86 )
    {
      if( v86 == 7 )
      {
        v88 = CurrentPrcb->SelfmapLockHandle[1].LockQueue.Next == 0i64;
      }
      else
      {
        if( v86 == 5 )
          Next = CurrentPrcb->SelfmapLockHandle[0].LockQueue.Next;
        else
          Next = CurrentPrcb->SelfmapLockHandle[3].LockQueue.Next;
        v88 = Next == 0i64;
      }
    }
    else
    {
      v88 = CurrentPrcb->SelfmapLockHandle[2].LockQueue.Next == 0i64;
    }
LABEL_189:
    if( !v88 )
      goto LABEL_234;
LABEL_190:
    v94 = (_DWORD *)((char *)&stru_140C4DB30 + 6544);
    if( (*(_BYTE *)(v40 + 184) & 7) != 2 )
      v94 = (_DWORD *)(v40 + 192);
    if( (*v94 & 0x40000000) != 0 )
      goto LABEL_234;
    if( v110 < 2u )
    {
      v95 = KeGetCurrentPrcb();
      DpcRequestSummary = (unsigned int)v95->DpcRequestSummary;
      if( (DpcRequestSummary & 1) != 0 )
      {
        v96 = 1;
        if( v95->DpcTimeCount > 7 )
        {
          if( v95->QuantumEnd )
          {
            v97 = 1;
LABEL_212:
            if( v97 )
            {
              v14 = v115;
LABEL_234:
              v27 = v14 + 8;
              goto LABEL_237;
            }
LABEL_213:
            v14 = v115;
            goto LABEL_214;
          }
LABEL_207:
          if( (DpcRequestSummary & 0x1E) != 0 )
          {
            v97 = 5;
            goto LABEL_212;
          }
          if( v95->CurrentThread != v95->IdleThread )
          {
            v97 = 6;
            goto LABEL_212;
          }
LABEL_211:
          _disable();
          v95->DpcWatchdogCount = v32;
          v95->DpcTimeCount = v32;
          KiResetGlobalDpcWatchdogProfiler((INT64)v95);
          _enable();
          v32 = 0;
          v97 = 0;
          goto LABEL_212;
        }
      }
      else
      {
        v96 = v32;
        if( (DpcRequestSummary & 0x1E) != 0 )
        {
          v97 = 2;
          goto LABEL_212;
        }
        if( v95->QuantumEnd )
        {
          v97 = 3;
          goto LABEL_212;
        }
        NextThread = v95->NextThread;
        if( NextThread && NextThread != v95->CurrentThread )
        {
          v97 = 4;
          goto LABEL_212;
        }
      }
      if( v95->DpcWatchdogCount <= 7u )
        goto LABEL_213;
      if( v96 )
        goto LABEL_207;
      goto LABEL_211;
    }
LABEL_214:
    if( v112 )
      goto LABEL_237;
    if( v16 )
      goto LABEL_237;
    v14 += 8i64;
    v115 = v14;
    if( v27 != v14 || v27 > v127 )
      goto LABEL_237;
    if( v120 )
      v118 = *(_QWORD *)v14;
    v18 = v32;
    v8 = ((v14 << 25) - v129) >> 16;
    v27 += 8i64;
  }
  v41 = v122;
  v34 = v125;
  v111 = v116;
  WsExclusive[0] = v123;
LABEL_236:
  v27 = v14;
LABEL_237:
  if( v121 )
    MiUnlockPageTableInternal(v114, v121);
  result = v34;
  v107 = v131;
  *v130 = (__int64)((v27 << 25) - v129) >> 16;
  v108 = WsExclusive[0];
  *(_DWORD *)v107 = v41;
  *(_DWORD *)v132 = v108;
  *(_WORD *)v133 = v111;
  return result;
}

Referenced by:

MiAllowProtectionChange
MiComparePteProtections
MiQueryAddressSpan
MiSetProtectionOnSection