MmInitializeHandBuiltProcess

NTSTATUS __stdcall MmInitializeHandBuiltProcess(_EPROCESS *Process, PULONG_PTR DirectoryTableBase){
  __int64 v3; 
  __int64 v4; 
  char *v5; 
  INT64 *SharedVm; 
  __int64 v7; 
  INT64 *v8; 
  NTSTATUS result; 
  INT64 *v10; 
  _QWORD *v11; 
  __int64 v12; 
  LODWORD(v3) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
  v4 = v3;
  if( !v3 )
    return -1073741670;
  ExInitializeAutoExpandPushLock((_EX_PUSH_LOCK_AUTO_EXPAND *)(v3 + 408), 1ui64);
  v5 = (char *)*((_QWORD *)KeGetCurrentThread() + 23);
  SharedVm = MiGetSharedVm((INT64)(v5 + 1664));
  v7 = *((_QWORD *)v5 + 5);
  *((_DWORD *)Process + 628) |= 0x20u;
  *((_QWORD *)Process + 153) = 0i64;
  v8 = SharedVm;
  *((_QWORD *)Process + 154) = 0i64;
  *((_QWORD *)Process + 5) = v7;
  *((_QWORD *)Process + 296) = (char *)Process + 2360;
  *((_QWORD *)Process + 295) = (char *)Process + 2360;
  *((_QWORD *)Process + 294) = 0i64;
  result = MiAllocateProcessShadow();
  if( result >= 0 )
  {
    v10 = MiGetSharedVm((INT64)Process + 1664);
    v11 = (_QWORD *)((char *)Process + 1704);
    *(_DWORD *)v10 = 0;
    *((_QWORD *)Process + 251) = 0i64;
    *((_QWORD *)Process + 222) = *((_QWORD *)v5 + 222);
    *((_QWORD *)Process + 227) = *((_QWORD *)v5 + 227);
    v10[6] = v8[6];
    v10[7] = v8[7];
    v12 = 8i64;
    *((_QWORD *)Process + 223) = *((_QWORD *)v5 + 223);
    *((_QWORD *)Process + 224) = *((_QWORD *)v5 + 224);
    *((_QWORD *)Process + 225) = *((_QWORD *)v5 + 225);
    *((_QWORD *)Process + 226) = *((_QWORD *)v5 + 226);
    *((_QWORD *)Process + 187) = *((_QWORD *)v5 + 187);
    *((_QWORD *)Process + 159) = *((_QWORD *)v5 + 159);
    *((_QWORD *)Process + 210) = v4;
    do
    {
      *v11 = *(_QWORD *)((char *)v11 + v5 - (char *)Process);
      ++v11;
      --v12;
    }
    while( v12 );
    MiInsertNewProcess(Process, 0i64);
    MiAllowWorkingSetExpansion((_MMSUPPORT_INSTANCE *)((char *)Process + 1664));
    return 0;
  }
  return result;
}

Referenced by: