MiBackSystemImageWithPagefile
__int64 __fastcall MiBackSystemImageWithPagefile(__int64 a1){
int v1;
void *v3;
int v4;
unsigned __int64 v5;
__int64 result;
unsigned int v7;
__int64 v8;
__int64 v9;
unsigned int v10;
__int128 v11;
v1 = *(_DWORD *)(a1 + 196);
v11 = 0i64;
if( (v1 & 0xC) != 0 )
return 0i64;
v3 = *(void **)(a1 + 48);
if( (unsigned int)MiGetSystemRegionType((UINT64)v3) == 1 )
return 3221225793i64;
v4 = v1;
if( *(_QWORD *)(a1 + 112) && (v1 & 2) == 0 && !(unsigned int)MI_IS_PHYSICAL_ADDRESS(v3) )
{
MiBackSingleImageWithPagefile(a1);
v4 = *(_DWORD *)(a1 + 196);
}
v5 = *(_QWORD *)(a1 + 136);
result = 0i64;
if( v5 != -2i64 && v5 != 1 )
{
if( (v5 & 1) != 0 )
{
*(_QWORD *)&v11 = 1i64;
*((_QWORD *)&v11 + 1) = v5 & 0xFFFFFFFFFFFFFFFEui64;
v5 = (unsigned __int64)&v11;
}
*(_DWORD *)(a1 + 196) = v4 | 8;
v7 = 0;
if( *(_QWORD *)v5 )
{
v8 = 0i64;
do
{
v9 = *(_QWORD *)(v5 + 8 * v8 + 8);
if( !v9 )
break;
if( *(_QWORD *)(v9 + 136) != 1i64 )
{
result = MiBackSystemImageWithPagefile(v9);
if( (int)result < 0 )
break;
}
v8 = ++v7;
}
while( (unsigned __int64)v7 < *(_QWORD *)v5 );
}
}
v10 = *(_DWORD *)(a1 + 196) & 0xFFFFFFF7;
*(_DWORD *)(a1 + 196) = v10;
if( (int)result >= 0 )
*(_DWORD *)(a1 + 196) = v10 | 4;
return result;
}Referenced by:
MiBackSystemImageWithPagefile
MmBackSystemImageWithPagefile