MiReferenceCfgVad

INT64 __fastcall MiReferenceCfgVad(INT64 a1, UINT64 a2, INT64 a3){
  int v4; 
  __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  INT64 v9; 
  unsigned __int64 v10; 
  int v11; 
  __int64 v13; 
  __int16 v14; 
  INT64 v15; 
  v4 = a3;
  v6 = 32i64 * (int)a3;
  v7 = *((_QWORD *)KeGetCurrentThread() + 23);
  v8 = *(_QWORD *)(v7 + 1680);
  v9 = MiObtainReferencedVadEx(a2, 2, &v15);
  v10 = *(unsigned int *)(v9 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v9 + 33) << 32);
  *(_QWORD *)(v6 + v8 + 456) = v9;
  *(_QWORD *)(v6 + v8 + 440) = a2;
  v11 = 0;
  *(_DWORD *)(v6 + v8 + 464) = 0;
  *(_QWORD *)(v6 + v8 + 448) = ((v10 + 1) << 12) - a2;
  if( v4 == 1 )
  {
    v13 = *(_QWORD *)(v7 + 1408);
    if( !v13 || (v14 = *(_WORD *)(v13 + 8)) == 0 )
      v14 = -31132;
    LOBYTE(v11) = v14 == 452;
    *(_DWORD *)(v6 + v8 + 464) = v11;
  }
  return MiUnlockVadShared(a1, v9);
}

Referenced by:

MiCfgInitializeProcess
MmInitializeProcessAddressSpace