MiReplicatePteChangeToProcess

VOID **__fastcall MiReplicatePteChangeToProcess(INT64 a1, UINT64 a2, UINT64 a3){
  UINT64 v4; 
  UINT64 v5; 
  char *v6; 
  INT64 *i; 
  INT64 v8; 
  INT64 v9; 
  __int64 v10; 
  unsigned __int64 *v12; 
  unsigned __int64 v13; 
  int v14; 

  v4 = a2;
  if( a1 )
  {
    v5 = *(_QWORD *)(a1 + 40) >> 12;
  }
  else
  {
    v12 = (unsigned __int64 *)((char *)&MmGetPteBase()->u.Long + ((a2 >> 9) & 0x7FFFFFFFF8i64));
    v13 = *v12;
    MiPteInShadowRange((UINT64)v12);
    v5 = (v13 >> 12) & 0xFFFFFFFFFi64;
  }
  v6 = (char *)MiMapPageInHyperSpaceWorker(v5, 0i64, 0x80000000ui64);
  for( i = (INT64 *)&v6[8 * ((v4 >> 3) & 0x1FF)]; v4 <= a3; ++i )
  {
    LODWORD(v8) = MI_READ_PTE_LOCK_FREE(v4);
    v9 = v8;
    LODWORD(v10) = MI_READ_PTE_LOCK_FREE((INT64)i);
    if( v9 != v10 )
    {
      if( (v9 & 1) != 0 )
      {
        if( (v10 & 1) != 0 )
        {
          MiTransformValidPteInPlace(i, v4, v9, 3ui64);
          goto LABEL_8;
        }
        LOBYTE(v14) = MiPteInShadowRange((UINT64)i);
        if( v14 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 )
          v9 |= 0x8000000000000000ui64;
      }
      else
      {
        MiPteInShadowRange((UINT64)i);
      }
      *i = v9;
    }
LABEL_8:
    v4 += 8i64;
  }
  MiUnmapPageInHyperSpaceWorker(v6, 0x11u, 0x80000000ui64);
  return MiShadowTopLevelPxes();
}

Referenced by: