MmCreateProcessAddressSpace

char __fastcall MmCreateProcessAddressSpace(__int64 a1, __int64 a2, unsigned __int64 a3, char a4, int a5, __int64 a6){
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  __int64 v9; 
  _MI_PARTITION *v10; 
  __int64 v11; 
  __int64 v12; 
  INT64 v13; 
  INT64 TopLevelPage; 
  _MM_SESSION_SPACE *v15; 
  INT64 v16; 
  __int64 v17; 
  CHAR v18; 
  INT64 v19; 
  CHAR v20; 
  __int64 v21; 
  UINT64 v23; 
  INT64 v24; 
  UINT64 v25[2]; 
  CHAR v26; 
  UINT64 *v27; 
  INT64 *v28; 
  CHAR v29; 
  _MM_SESSION_SPACE *SessionGlobal; 
  UINT64 v31; 
  v31 = a3;
  SessionGlobal = 0i64;
  v7 = PspMinimumWorkingSet;
  v8 = a3;
  v9 = a6;
  v25[0] = PspMinimumWorkingSet;
  if( a1 )
    v10 = **(_MI_PARTITION ***)(a6 + 2520);
  else
    v10 = (_MI_PARTITION *)&MiSystemPartition;
  if( !MiMakePartitionActive(v10) )
    return 0;
  MiSetProcessPartitionId(v9, *(_WORD *)v10);
  if( !(unsigned int)MiChargeCommit(v10, 4ui64, 0i64) )
    return 0;
  *(_DWORD *)(v9 + 1664) = (unsigned __int16)RtlRandomEx((UINT64 *)&Seed);
  *(_QWORD *)(v9 + 2368) = v9 + 2360;
  *(_QWORD *)(v9 + 2360) = v9 + 2360;
  *(_QWORD *)(v9 + 2352) = 0i64;
  if( v8 != PsGetDefaultWsMaximum() )
  {
    MiCheckWsLimits(v9 + 1664, v25, &v31, a4, 1);
    v8 = v31;
    v7 = v25[0];
  }
  *(_QWORD *)(v9 + 1776) = v7;
  *(_QWORD *)(v9 + 1816) = v8;
  if( (a4 & 1) != 0 )
    *(_BYTE *)(v9 + 1848) |= 0x40u;
  if( (int)PsChargeProcessQuota(v9, v11, v7) < 0 )
  {
LABEL_23:
    MiReturnCommit(v10, 4ui64);
    return 0;
  }
  if( !(unsigned int)MiChargeResident((ULONG_PTR *)v10, v7, 0i64) )
  {
LABEL_22:
    PsReturnProcessQuota(v9, v12, v7);
    goto LABEL_23;
  }
  v13 = MiReservePtes((INT64)&qword_140C4EC80, 1ui64);
  if( !v13 )
  {
LABEL_21:
    MiReturnResident((INT64)v10, v7);
    goto LABEL_22;
  }
  if( (int)MiAllocateProcessShadow() < 0 )
  {
LABEL_20:
    MiReleasePtes((INT64)&qword_140C4EC80, v13, 1ui64);
    goto LABEL_21;
  }
  if( !(unsigned int)MiJoinSession((volatile signed __int32 **)&SessionGlobal) )
  {
    MiDeleteProcessShadow();
    goto LABEL_20;
  }
  *(_QWORD *)(v9 + 1608) = 4i64;
  TopLevelPage = MiAllocateTopLevelPage(v9, (UINT64 *)v13);
  v15 = SessionGlobal;
  v16 = TopLevelPage;
  if( SessionGlobal )
  {
    *(_QWORD *)(v9 + 1368) = SessionGlobal;
    _InterlockedOr((volatile signed __int32 *)(v9 + 1124), 0x10000u);
    v15 = SessionGlobal;
  }
  MiInsertNewProcess((_EPROCESS *)v9, v15);
  v17 = ((v13 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  MiCreateNewProcessTopLevelMappings(v9, v17);
  *(_QWORD *)(v17 + 8 * (((unsigned __int64)MmGetPxeSelfRef() >> 3) & 0x1FF)) = MiMakeValidPte(0i64, v16, 2415919110i64) & 0xFFFFFFFFFFFFFEFFui64;
  LODWORD(v21) = KeMakeKernelDirectoryTableBase(
                   (UINT64 *)(v16 << 12),
                   v18,
                   v19,
                   v20,
                   v23,
                   v24,
                   (PRIVILEGE_SET **)v25[0],
                   (INT64 *)v25[1],
                   v26,
                   v27,
                   v28,
                   v29);
  *(_QWORD *)(v9 + 40) = v21;
  MiSyncSystemPdes(v9);
  MiReleasePtes((INT64)&qword_140C4EC80, v13, 1ui64);
  return 1;
}

Referenced by: