MmCreateShadowMapping

NTSTATUS __stdcall MmCreateShadowMapping(VOID *Va, INT64 a2){
  _MMPTE *v4; 
  UINT64 v5; 
  VOID *v6; 
  _MI_SYSTEM_VA_TYPE v7; 
  int v8; 
  _MMPTE *PteAddress; 
  _MMPTE **v10; 
  __int64 v11; 
  _ETHREAD *CurrentThread; 
  PEPROCESS v13; 
  _EPROCESS *Process; 
  char v15; 
  __int64 PageTableCount[2]; 
  _MI_ZERO_PAGE_TABLE_CREATION PageTableCreation[76]; 
  _KAPC_STATE ApcState; 
  char v20[8]; 

  PageTableCount[0] = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  memset(PageTableCreation, 0i64, 0x128u);
  PageTableCreation[16] = 1;
  *(_QWORD *)&PageTableCreation[8] = &Irp;
  PageTableCreation[14] = 12;
  v4 = (_MMPTE *)((char *)Va + a2 - 1);
  MiInitializeColorBase(Va, 0i64);
  MiPageTablesNeeded(Va, v4, v5);
  MiGetPageTablePages(PageTableCreation, v6, (UINT64)PageTableCount, v7);
  if( v8 < 0 )
    return 0;
  *(_QWORD *)&PageTableCreation[6] = PageTableCount[0];
  do
  {
    Va = MiGetPteAddress(Va);
    PteAddress = MiGetPteAddress(v4);
    *v10 = PteAddress;
    v4 = PteAddress;
    *(v10 - 1) = (_MMPTE *)Va;
  }
  while( v11 != 1 );
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v13 = PsInitialSystemProcess;
  Process = CurrentThread->Tcb.ApcState.Process;
  if( Process != PsInitialSystemProcess )
    KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx(&Lock, 0i64);
  MiMakeShadowPageTableRange((unsigned __int64)Va, (unsigned __int64)v4, (__int64)v20, 3, (__int64)PageTableCreation);
  v15 = _InterlockedExchangeAdd64(&Lock._bf_0, 0xFFFFFFFFFFFFFFFFui64);
  if( (v15 & 2) != 0 && (v15 & 4) == 0 )
    ExfTryToWakePushLock(&Lock);
  KeAbPostRelease(&Lock);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( Process != v13 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  MiCleanupPageTablePages(PageTableCreation);
  return 1;
}

Referenced by: