MiWriteEnclavePte

NTSTATUS __fastcall MiWriteEnclavePte(UINT64 a1, INT64 a2, INT64 a3, INT64 a4, INT64 a5){
  int v5; 
  _MMSUPPORT_FULL *p_Vm; 
  char *v10; 
  UINT8 v11; 
  char v12; 
  NTSTATUS result; 
  __int64 v14; 
  __int64 v15; 
  int v16; 
  INT64 v17; 
  INT64 v18; 
  UINT64 v19; 
  UINT64 v20; 

  v5 = a4;
  p_Vm = &KeGetCurrentThread()->ApcState.Process->Vm;
  v10 = (char *)MmGetPteBase() + ((a1 >> 9) & 0x7FFFFFFFF8i64);
  if( (_DWORD)a5 )
  {
    MiLockWorkingSetShared();
    LODWORD(v20) = 0;
    v12 = v11;
    MiMakeSystemAddressValid((VOID *)a1, 0i64, (*(_DWORD *)(a3 + 48) >> 12) & 0x3F, v11, v20);
  }
  else
  {
    v12 = 17;
  }
  if( v5 )
  {
    LOBYTE(result) = MiWriteValidPteNewProtection((INT64 *)a1, a2);
  }
  else
  {
    LODWORD(v14) = MI_READ_PTE_LOCK_FREE(a1);
    v15 = v14;
    LOBYTE(v16) = MiPteInShadowRange(a1);
    v17 = 1i64;
    if( v16 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (a2 & 1) != 0 )
      a2 |= 0x8000000000000000ui64;
    *(_QWORD *)a1 = a2;
    v18 = 0i64;
    if( v15 )
    {
      if( (v15 & 0xC00) == 2048 )
        v17 = 0i64;
    }
    else
    {
      v18 = 1i64;
    }
    result = v17 | v18;
    if( v17 | (unsigned int)v18 )
      result = MiUpdateAwePageTable((UINT64)v10, v17, v18);
  }
  if( (_DWORD)a5 )
  {
    MiUnlockPageTableInternal((INT64)p_Vm, (UINT64)v10);
    LOBYTE(v19) = v12;
    MiUnlockWorkingSetShared(&p_Vm->Instance, v19);
  }
  return result;
}

Referenced by: