MmCheckProcessShadow

INT64 __stdcall MmCheckProcessShadow(){
  _ETHREAD *CurrentThread; 
  INT64 v1; 
  UINT8 v2; 
  INT64 v3; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v1 = *((_QWORD *)CurrentThread + 23);
  --*((_WORD *)CurrentThread + 243);
  ExAcquirePushLockSharedEx((UINT64)&P2, 0i64);
  v1 += 1664i64;
  v2 = MiLockWorkingSetShared(v1);
  v3 = MiCheckProcessShadow();
  MiUnlockWorkingSetShared(v1, v2);
  if( _InterlockedCompareExchange64((volatile signed __int64 *)&P2, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)&P2);
  KeAbPostRelease(&P2);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return v3;
}

Referenced by: