MmInitializeProcessAddressSpace

VOID __fastcall MmInitializeProcessAddressSpace(
        _EPROCESS *ProcessToInitialize,
        _EPROCESS *ProcessToClone,
        VOID *SectionToMap,
        UINT64 *CreateFlags,
        UINT64 CloneFlags){
  char *Pool; 
  _MMWSL_INSTANCE *v10; 
  _MMSUPPORT_FULL *p_Vm; 
  _MMWSL_INSTANCE *v12; 
  VOID **v13; 
  INT64 v14; 
  VOID *v15; 
  _MMWSL_INSTANCE *VmWorkingSetList; 
  __int64 v17; 
  __int64 v18; 
  __int128 v19; 
  __int64 NextPteToTrim; 
  __int128 v21; 
  VOID **v22; 
  __int128 v23; 
  __int128 v24; 
  __int64 v25; 
  __int128 v26; 
  __int128 v27; 
  void *Peb; 
  _EWOW64PROCESS *WoW64Process; 
  NTSTATUS v30; 
  __int64 v31; 
  _MMWSL_INSTANCE *v32; 
  _ETHREAD *CurrentThread; 
  VOID **NoAccessVa; 
  _MMVAD_SHORT *VadList; 
  __int64 v36; 
  __int64 v37; 
  VOID *v38[8]; 
  _KAPC_STATE ApcState; 
  char Src[224]; 

  memset(&ApcState, 0, sizeof(ApcState));
  memset(Src, 0i64, 0xD8u);
  Pool = (char *)MiAllocatePool(64i64, 0x270ui64, 0x3250694Dui64);
  v10 = (_MMWSL_INSTANCE *)Pool;
  if( Pool )
  {
    ExInitializeAutoExpandPushLock((_EX_PUSH_LOCK_AUTO_EXPAND *)(Pool + 408), 1ui64);
    if( ProcessToClone )
    {
      VmWorkingSetList = ProcessToClone->Vm.Instance.VmWorkingSetList;
      memmove(Src, &VmWorkingSetList[1].NextPteToAge, 0xD8u);
      v17 = *(_QWORD *)&VmWorkingSetList[6].LastAccessClearingRemainder;
      v18 = 2i64;
      v19 = *(_OWORD *)&VmWorkingSetList[11].NextPteToAccessClear;
      NextPteToTrim = (__int64)VmWorkingSetList[9].NextPteToTrim;
      *(_OWORD *)v38 = *(_OWORD *)&VmWorkingSetList[11].NextPteToTrim;
      v21 = *(_OWORD *)&VmWorkingSetList[11].LockedEntries;
      v36 = v17;
      v22 = &v38[2];
      *(_OWORD *)&v38[2] = v19;
      v23 = *(_OWORD *)&VmWorkingSetList[12].NextPteToAge;
      v37 = NextPteToTrim;
      *(_OWORD *)&v38[4] = v21;
      *(_OWORD *)&v38[6] = v23;
      do
      {
        *v22 = 0i64;
        v22 += 4;
        --v18;
      }
      while( v18 );
    }
    else
    {
      v36 = 0i64;
      v37 = 0i64;
      memset(v38, 0i64, sizeof(v38));
    }
    KiStackAttachProcess(ProcessToInitialize, 0i64, &ApcState);
    ProcessToInitialize->AddressCreationLock._bf_0 = 0i64;
    ProcessToInitialize->PageTableCommitmentLock._bf_0 = 0i64;
    ProcessToInitialize->VadRoot.Root = 0i64;
    if( (MmTrackLockedPages & 1) != 0 && (MmTrackLockedPages & 0x10000000) == 0 )
      MiInitializeLockedPagesTracking(ProcessToInitialize);
    p_Vm = &ProcessToInitialize->Vm;
    NoAccessVa = 0i64;
    MiInitializeWorkingSetList(&ProcessToInitialize->Vm.Instance, v10, 0i64, 0i64);
    v12 = ProcessToInitialize->Vm.Instance.VmWorkingSetList;
    LODWORD(v12[7].NextPteToTrim) = 1;
    MiInitializeProcessPageTableCommitmentBitMaps((INT64)ProcessToInitialize);
    _InterlockedOr((volatile signed __int32 *)&ProcessToInitialize->1124, 0x400u);
    VadList = 0i64;
    if( MiComputeProcessUserVa(
           (ULONG_PTR)ProcessToInitialize,
           ProcessToClone,
           (_SECTION *)SectionToMap,
           &VadList,
           NoAccessVa) < 0 )
      goto LABEL_25;
    if( !ProcessToClone && (ProcessToInitialize->Flags3 & 1) == 0 )
    {
      MiAllocateProcessVads();
      NoAccessVa = v13;
      if( !v13 )
        goto LABEL_25;
    }
    InitializeSListHead((PSLIST_HEADER)&v12[9].NextPteToAge);
    if( !ProcessToClone )
    {
      MiInitializeProcessBottomUpEntropy(ProcessToInitialize);
      MiInitializeProcessTopDownEntropy(ProcessToInitialize, (_SECTION *)SectionToMap, v14);
      if( MiInitializeVadBitMap(0i64) < 0 )
        goto LABEL_25;
    }
    if( MiInsertProcessVads(ProcessToInitialize, (_MMVAD_SHORT **)&NoAccessVa) < 0 )
      goto LABEL_25;
    if( SectionToMap )
    {
      MiMapProcessExecutable(ProcessToInitialize, (_SECTION *)SectionToMap, CreateFlags, v15);
LABEL_14:
      MiAllowWorkingSetExpansion(&ProcessToInitialize->Vm.Instance);
LABEL_18:
      KiUnstackDetachProcess(&ApcState, 0i64);
      return;
    }
    if( (ProcessToInitialize->Flags3 & 1) != 0 && !ProcessToClone )
      goto LABEL_14;
    *(_DWORD *)CreateFlags &= ~0x10u;
    if( !ProcessToClone )
      goto LABEL_18;
    if( (*(_BYTE *)&ProcessToClone->Pcb.SecureState & 1) != 0 )
      goto LABEL_25;
    *(_QWORD *)ProcessToInitialize->ImageFileName = *(_QWORD *)ProcessToClone->ImageFileName;
    *(_DWORD *)&ProcessToInitialize->ImageFileName[8] = *(_DWORD *)&ProcessToClone->ImageFileName[8];
    *(_WORD *)&ProcessToInitialize->ImageFileName[12] = *(_WORD *)&ProcessToClone->ImageFileName[12];
    ProcessToInitialize->ImageFileName[14] = ProcessToClone->ImageFileName[14];
    ProcessToInitialize->HighestUserAddress = ProcessToClone->HighestUserAddress;
    memmove(&v12[1].NextPteToAge, Src, 0xD8u);
    v24 = *(_OWORD *)&v38[2];
    v25 = v36;
    *(_OWORD *)&v12[11].NextPteToTrim = *(_OWORD *)v38;
    *(_QWORD *)&v12[6].LastAccessClearingRemainder = v25;
    v26 = *(_OWORD *)&v38[4];
    *(_OWORD *)&v12[11].NextPteToAccessClear = v24;
    v27 = *(_OWORD *)&v38[6];
    *(_OWORD *)&v12[11].LockedEntries = v26;
    *(_OWORD *)&v12[12].NextPteToAge = v27;
    if( MiInitializeVadBitMap(1ui64) < 0 )
    {
LABEL_25:
      MiReturnProcessVads((_MMVAD_SHORT *)NoAccessVa);
      goto LABEL_18;
    }
    WoW64Process = ProcessToClone->WoW64Process;
    if( WoW64Process )
    {
      Peb = WoW64Process->Peb;
      if( WoW64Process->Peb )
        ProcessToInitialize->WoW64Process->Peb = Peb;
    }
    if( (*(_DWORD *)CreateFlags & 0x80u) == 0 )
      v30 = 0;
    else
      v30 = MiSessionCreate((UINT64 *)Peb);
    v31 = 2i64;
    v12[9].NextPteToTrim = (_MMPTE *)((v37 + 1) & -(__int64)((CloneFlags & 1) != 0));
    v32 = v12 + 8;
    do
    {
      v32->NextPteToAge = (_MMPTE *)v32;
      v32->NextPteToTrim = (_MMPTE *)v32;
      v32 = (_MMWSL_INSTANCE *)((char *)v32 + 16);
      --v31;
    }
    while( v31 );
    KiUnstackDetachProcess(&ApcState, 0i64);
    if( v30 >= 0
      && MiCloneProcessAddressSpace((ULONG_PTR)ProcessToClone, (ULONG_PTR)ProcessToInitialize, (unsigned int)CloneFlags) >= 0 )
    {
      KiStackAttachProcess(ProcessToInitialize, 0i64, &ApcState);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      if( v38[5] )
        MiReferenceCfgVad(CurrentThread, v38[4], CfgBitMapWow64);
      if( v38[1] )
        MiReferenceCfgVad(CurrentThread, v38[0], CfgBitMapNative);
      KiUnstackDetachProcess(&ApcState, 0i64);
    }
    MiAllowWorkingSetExpansion(&p_Vm->Instance);
  }
}

Referenced by: