MmCreateMirror

NTSTATUS MmCreateMirror(void){
  INT8 v0; 
  UNICODE_STRING ValueName; 
  __int64 v3[4]; 
  int v4; 
  int v5; 
  int Data; 
  UINT64 ResultDataSize; 
  UINT64 Type; 
  v5 = 0;
  LODWORD(Type) = 0;
  Data = 0;
  ValueName.Buffer = L"Kernel-MemoryMirroringSupported";
  *(_QWORD *)&ValueName.Length = 4194366i64;
  LODWORD(ResultDataSize) = 4;
  if( ZwQueryLicenseValue(&ValueName, &Type, &Data, 4ui64, &ResultDataSize) < 0 || Data != 1 )
    return -1073741206;
  v0 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v0 && !SeSinglePrivilegeCheck(*(_QWORD *)&SeShutdownPrivilege, v0) )
    return -1073741727;
  if( (dword_140CFA184 & 1) == 0 )
    return -1073741637;
  v3[0] = (__int64)off_140C00AE0[0];
  v3[1] = (__int64)off_140C00AE8[0];
  v3[2] = (__int64)off_140C00AF0[0];
  v3[3] = (unsigned __int64)off_140C00B00 & -(__int64)((dword_140CFA184 & 2) != 0);
  v4 = 2;
  return MmDuplicateMemory((__int64)v3);
}

Referenced by: