MiReferenceCfgVad
INT64 __fastcall MiReferenceCfgVad(INT64 a1, UINT64 a2, INT64 a3){
int v4;
__int64 v6;
__int64 v7;
__int64 v8;
INT64 v9;
unsigned __int64 v10;
int v11;
__int64 v13;
__int16 v14;
INT64 v15;
v4 = a3;
v6 = 32i64 * (int)a3;
v7 = *((_QWORD *)KeGetCurrentThread() + 23);
v8 = *(_QWORD *)(v7 + 1680);
v9 = MiObtainReferencedVadEx(a2, 2, &v15);
v10 = *(unsigned int *)(v9 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v9 + 33) << 32);
*(_QWORD *)(v6 + v8 + 456) = v9;
*(_QWORD *)(v6 + v8 + 440) = a2;
v11 = 0;
*(_DWORD *)(v6 + v8 + 464) = 0;
*(_QWORD *)(v6 + v8 + 448) = ((v10 + 1) << 12) - a2;
if( v4 == 1 )
{
v13 = *(_QWORD *)(v7 + 1408);
if( !v13 || (v14 = *(_WORD *)(v13 + 8)) == 0 )
v14 = -31132;
LOBYTE(v11) = v14 == 452;
*(_DWORD *)(v6 + v8 + 464) = v11;
}
return MiUnlockVadShared(a1, v9);
}Referenced by:
MiCfgInitializeProcess
MmInitializeProcessAddressSpace