MiCloneProcessAddressSpace

NTSTATUS __stdcall MiCloneProcessAddressSpace(
        ULONG_PTR ProcessToClone,
        ULONG_PTR ProcessToInitialize,
        UINT64 CloneFlags){
  char v3; 
  _EPROCESS *v4; 
  _EPROCESS *v5; 
  int v6; 
  _MMCLONE_DESCRIPTOR *v7; 
  _EPROCESS *Process; 
  int v10; 
  int CloneChain; 
  UINT64 v12; 
  _QWORD *v13; 
  _QWORD *v14; 
  _MMCLONE_DESCRIPTOR *v15; 
  unsigned __int64 NumberOfPtes; 
  volatile unsigned __int64 v17; 
  unsigned int v18; 
  __int64 v19; 
  UINT64 CloneFlagsa; 
  PVOID P; 
  UINT64 v22; 
  UINT64 LargePageVads; 
  UINT64 NumberOfVads; 
  _MMWSL_INSTANCE *VmWorkingSetList; 
  _EPROCESS *v26; 
  _KAPC_STATE ApcState; 

  LODWORD(v22) = CloneFlags;
  LargePageVads = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v3 = CloneFlags;
  v4 = *(_EPROCESS **)&ProcessToInitialize;
  v5 = *(_EPROCESS **)&ProcessToClone;
  v6 = 0;
  P = 0i64;
  v7 = 0i64;
  Process = KeGetCurrentThread()->ApcState.Process;
  v26 = Process;
  if( MiIsStoreProcess(*(_EPROCESS **)&ProcessToClone) )
    return -1073741637;
  MiLockDownWorkingSet((ULONG_PTR)v4, 1ui64);
  if( Process != v5 )
  {
    v6 = 1;
    KiStackAttachProcess(v5, 0i64, &ApcState);
  }
  v10 = v3 & 1;
  VmWorkingSetList = v5->Vm.Instance.VmWorkingSetList;
  if( !VmWorkingSetList[9].NextPteToTrim || v10 )
  {
    LODWORD(v12) = MiLockVadRange(v5, (VOID *)0xFFFFFFFFFFFFFFFFi64, (VOID *)0xFFFFFFFFFFFFFFFFi64);
    NumberOfVads = v12;
    if( v12 )
    {
      CloneChain = MiCreateCloneChain(v4, (_MMCLONE_DESCRIPTOR **)&P);
      if( CloneChain < 0 )
        goto LABEL_10;
      CloneChain = MiAllocateChildVads((ULONG_PTR)v4, &LargePageVads);
      if( CloneChain < 0 )
        goto LABEL_10;
      if( v10 )
      {
        v15 = MiBuildNewCloneDescriptor((ULONG_PTR)v4, 2ui64, (UINT64)VmWorkingSetList[9].NextPteToTrim);
        v7 = v15;
        if( !v15 )
        {
          CloneChain = -1073741670;
          goto LABEL_10;
        }
        memset(v15->StartingCloneBlock, 0i64, 32 * v15->NumberOfPtes);
        v7->StartingCloneBlock->CloneCommitCount = v7->StartingCloneBlock->CloneCommitCount & 0x7FFFFFFFFFFFFFFi64 | 0x2000000000000000i64;
        v7->StartingCloneBlock[1].CloneCommitCount = v7->StartingCloneBlock[1].CloneCommitCount & 0x7FFFFFFFFFFFFFFi64 | 0x800000000000000i64;
      }
      LODWORD(CloneFlagsa) = v22;
      CloneChain = MiCloneVads(v5, v4, (_MMCLONE_DESCRIPTOR *)P, v7, CloneFlagsa);
      if( CloneChain >= 0 )
      {
        P = 0i64;
        CloneChain = MiMapChildLargePageVads((ULONG_PTR)v4, LargePageVads);
        MiUnlockVadRange(v5, (VOID *)0xFFFFFFFFFFFFFFFFi64, NumberOfVads);
        if( v6 )
        {
          KiUnstackDetachProcess(&ApcState, 0i64);
          v6 = 0;
        }
        if( v26 != v4 )
        {
          v6 = 1;
          KiStackAttachProcess(v4, 0i64, &ApcState);
        }
        MiCreateForkWsles();
        if( v7 )
        {
          NumberOfPtes = v7->NumberOfPtes;
          v17 = 0i64;
          v18 = 0;
          if( !NumberOfPtes )
            goto LABEL_36;
          v19 = 0i64;
          do
          {
            ++v18;
            v17 += v7->StartingCloneBlock[v19].CloneRefCount;
            v19 = v18;
          }
          while( v18 < NumberOfPtes );
          if( v17 )
          {
            v7->NumberOfReferences = v17;
            MiInsertClone(v4, v7);
          }
          else
          {
LABEL_36:
            MiFreeCloneDescriptor((ULONG_PTR)v4, (ULONG_PTR)v7);
          }
          v7 = 0i64;
        }
        if( CloneChain >= 0 )
        {
          MiLockDownWorkingSet((ULONG_PTR)v4, 0i64);
          if( v6 )
            KiUnstackDetachProcess(&ApcState, 0i64);
          return CloneChain;
        }
        goto LABEL_11;
      }
    }
    else
    {
      CloneChain = -1073741558;
    }
LABEL_10:
    MiUnlockVadRange(v5, (VOID *)0xFFFFFFFFFFFFFFFFi64, NumberOfVads);
LABEL_11:
    v13 = P;
    if( P )
    {
      do
      {
        v14 = (_QWORD *)*v13;
        PsReturnProcessNonPagedPoolQuota(v4, v13[8]);
        ExFreePoolWithTag(v13, 0);
        v13 = v14;
      }
      while( v14 );
    }
    if( v7 )
      MiFreeCloneDescriptor((ULONG_PTR)v4, (ULONG_PTR)v7);
    goto LABEL_15;
  }
  CloneChain = -1073741637;
LABEL_15:
  if( v6 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  MiLockDownWorkingSet((ULONG_PTR)v4, 0i64);
  MiDeleteInsertedCloneVads(v4);
  return CloneChain;
}

Referenced by: