MiReplicatePteChangeToProcess

VOID **__fastcall MiReplicatePteChangeToProcess(INT64 a1, UINT64 a2, UINT64 a3){
  UINT64 v4; 
  UINT64 v5; 
  char *v6; 
  void *v7; 
  volatile INT64 *i; 
  INT64 v9; 
  INT64 v10; 
  unsigned __int64 *v12; 
  unsigned __int64 v13; 
  v4 = a2;
  if( a1 )
  {
    v5 = *(_QWORD *)(a1 + 40) >> 12;
  }
  else
  {
    v12 = (unsigned __int64 *)((char *)MmGetPteBase() + ((a2 >> 9) & 0x7FFFFFFFF8i64));
    v13 = *v12;
    MiPteInShadowRange((UINT64)v12);
    v5 = (v13 >> 12) & 0xFFFFFFFFFi64;
  }
  LODWORD(v6) = MiMapPageInHyperSpaceWorker(v5, 0i64, 0x80000000ui64);
  v7 = v6;
  for( i = (volatile INT64 *)&v6[8 * ((v4 >> 3) & 0x1FF)]; v4 <= a3; ++i )
  {
    v9 = MI_READ_PTE_LOCK_FREE(v4);
    v10 = MI_READ_PTE_LOCK_FREE((INT64)i);
    if( v9 != v10 )
    {
      if( (v9 & 1) != 0 && (v10 & 1) != 0 )
        MiTransformValidPteInPlace(i, v4, v9, 3ui64);
      else
        *i = v9;
    }
    v4 += 8i64;
  }
  MiUnmapPageInHyperSpaceWorker(v7, 0x11u, 0x80000000ui64);
  return MiShadowTopLevelPxes();
}

Referenced by: