MmCreateProcessAddressSpace

UINT8 __stdcall MmCreateProcessAddressSpace(UINT64 MaximumWorkingSetSize, UINT64 Flags, _EPROCESS *NewProcess){
  unsigned int v3; 
  unsigned int v4; 
  UINT64 v5; 
  UINT64 v6; 
  _EPROCESS *v7; 
  _MI_PARTITION *v8; 
  UINT64 v9; 
  UINT64 v10; 
  _MMPTE *v11; 
  _KTBFLUSH_TYPE v12; 
  UINT64 TopLevelPage; 
  _MM_SESSION_SPACE *v14; 
  INT64 v15; 
  __int64 v16; 
  unsigned __int64 *v17; 
  __int64 v18; 
  unsigned __int64 v19; 
  int v20; 
  unsigned __int64 v21; 
  _KTBFLUSH_TYPE v22; 
  UINT64 VerifyFlags; 
  __int64 WorkingSetMinimumInOut[2]; 
  _MM_SESSION_SPACE *SessionGlobalJoined; 
  UINT64 WorkingSetMaximumInOut; 
  INT64 v28; 

  WorkingSetMaximumInOut = (UINT64)NewProcess;
  SessionGlobalJoined = 0i64;
  v4 = v3;
  v5 = PspMinimumWorkingSet;
  v6 = (UINT64)NewProcess;
  v7 = (_EPROCESS *)v28;
  WorkingSetMinimumInOut[0] = PspMinimumWorkingSet;
  if( MaximumWorkingSetSize )
    v8 = **(_MI_PARTITION ***)(v28 + 2520);
  else
    v8 = &Irp;
  if( !MiMakePartitionActive(v8) )
    return 0;
  MiSetProcessPartitionId((INT64)v7, v8->Core.PartitionId);
  if( !MiChargeCommit(v8, 4ui64, 0i64) )
    return 0;
  v7->Vm.Instance.NextPageColor = (unsigned __int16)RtlRandomEx((UINT64 *)&stru_140C4DB30 + 5);
  v7->SharedCommitLinks.Blink = &v7->SharedCommitLinks;
  v7->SharedCommitLinks.Flink = &v7->SharedCommitLinks;
  v7->SharedCommitLock._bf_0 = 0i64;
  if( v6 != PsGetDefaultWsMaximum() )
  {
    LODWORD(VerifyFlags) = 1;
    MiCheckWsLimits(&v7->Vm.Instance, (UINT64 *)WorkingSetMinimumInOut, &WorkingSetMaximumInOut, v4, VerifyFlags);
    v6 = WorkingSetMaximumInOut;
    v5 = WorkingSetMinimumInOut[0];
  }
  v7->Vm.Instance.MinimumWorkingSetSize = v5;
  v7->Vm.Instance.MaximumWorkingSetSize = v6;
  if( (v4 & 1) != 0 )
    v7->Vm.Instance.Flags._bf_0 |= 0x40u;
  if( PsChargeProcessQuota(v7, v9) < 0 )
  {
LABEL_24:
    MiReturnCommit(v8, 4ui64);
    return 0;
  }
  if( MiChargeResident((ULONG_PTR *)&v8->Core.PartitionId, v5, 0i64) == MiChargeFailed )
  {
LABEL_23:
    PsReturnProcessQuota(v7, v10);
    goto LABEL_24;
  }
  v11 = MiReservePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), 1ui64);
  if( !v11 )
  {
LABEL_22:
    MiReturnResident((INT64)v8, v5);
    goto LABEL_23;
  }
  if( MiAllocateProcessShadow() < 0 )
  {
LABEL_21:
    MiReleasePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), v11, 1ui64, v12);
    goto LABEL_22;
  }
  if( !MiJoinSession(&SessionGlobalJoined) )
  {
    MiDeleteProcessShadow();
    goto LABEL_21;
  }
  v7->CommitCharge = 4i64;
  TopLevelPage = MiAllocateTopLevelPage(v7, (UINT64)v11);
  v14 = SessionGlobalJoined;
  v15 = TopLevelPage;
  if( SessionGlobalJoined )
  {
    v7->Session = SessionGlobalJoined;
    _InterlockedOr((volatile signed __int32 *)&v7->1124, 0x10000u);
    v14 = SessionGlobalJoined;
  }
  MiInsertNewProcess(v7, v14);
  v16 = (__int64)(((_QWORD)v11 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  MiCreateNewProcessTopLevelMappings(v7, (_MMPTE *)v16);
  v17 = (unsigned __int64 *)(v16 + 8 * (((unsigned __int64)MmGetPxeSelfRef() >> 3) & 0x1FF));
  LODWORD(v18) = MiMakeValidPte(0i64, v15, 2415919110i64);
  v19 = v18 & 0xFFFFFFFFFFFFFEFFui64;
  LOBYTE(v20) = MiPteInShadowRange((UINT64)v17);
  if( v20 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v19 & 1) != 0 )
    v19 |= 0x8000000000000000ui64;
  *v17 = v19;
  LODWORD(v21) = KeMakeKernelDirectoryTableBase(v15 << 12);
  v7->Pcb.DirectoryTableBase = v21;
  MiSyncSystemPdes(v7);
  MiReleasePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), v11, 1ui64, v22);
  return 1;
}

Referenced by: