MiComputeProcessUserVa

NTSTATUS __stdcall MiComputeProcessUserVa(
        ULONG_PTR ProcessToInitialize,
        _EPROCESS *ProcessToClone,
        _SECTION *Section,
        _MMVAD_SHORT **VadList,
        VOID **NoAccessVa){
  __int64 v5; 
  __int64 v6; 
  _QWORD *v8; 
  unsigned __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  NTSTATUS result; 
  __int16 v15; 

  v5 = *(_QWORD *)(*(_QWORD *)&ProcessToInitialize + 1680i64);
  v6 = *(_QWORD *)&ProcessToInitialize;
  *VadList = 0i64;
  v8 = (_QWORD *)(v5 + 320);
  v11 = 0x7FFFFFFF0000i64;
  v12 = 2i64;
  do
  {
    v8[1] = v8;
    *v8 = v8;
    v8 += 2;
    --v12;
  }
  while( v12 );
  if( !MiCreateSystemWsles() && (*(_DWORD *)(v6 + 2172) & 1) == 0 )
  {
    result = MiChargeFullProcessCommitment(v6, 4ui64);
    if( result < 0 )
      return result;
    MiUpdateChargedWsles(v6 + 1664);
  }
  if( !ProcessToClone && Section && (Section->u.LongFlags & 0x20) != 0 && (*(_DWORD *)(v6 + 1124) & 0x20000) == 0 )
  {
    if( (MiSectionControlArea(Section)->Segment->u2.ImageInformation->ExportedImageInformation.ImageCharacteristics & 0x20) != 0 )
    {
      v13 = *(_QWORD *)(v6 + 1408);
      if( v13 )
      {
        v15 = *(_WORD *)(v13 + 8);
        if( v15 == 332 || v15 == 452 )
        {
          v11 = 4294901760i64;
          *VadList = (_MMVAD_SHORT *)0x100000000i64;
          _InterlockedOr((volatile signed __int32 *)(v6 + 1124), 0x200u);
        }
      }
    }
    else
    {
      v11 = 2147418112i64;
      *VadList = (_MMVAD_SHORT *)0x100000000i64;
    }
  }
  if( dword_140CFA190 )
  {
    if( v11 > 0x80000000 )
      _InterlockedOr((volatile signed __int32 *)(v6 + 1124), 0x200000u);
  }
  *(_QWORD *)(v6 + 1496) = v11;
  return 0;
}

Referenced by: