MiInsertChildVads

__int64 __fastcall MiInsertChildVads(ULONG_PTR a1, _DWORD *a2){
  int v4; 
  const _UNICODE_STRING *v5; 
  UINT8 v6; 
  _DWORD *v7; 
  int *v8; 
  int v9; 
  int inserted; 
  int v11; 
  __int64 v12; 
  int v13; 
  void *v14; 
  _ETHREAD *CurrentThread; 
  __int64 v16; 
  bool v17; 
  _KAPC_STATE ApcState; 
  v4 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  KiStackAttachProcess((_KPROCESS *)a1, 0i64, &ApcState);
  v7 = a2;
  if( a2 )
  {
    while( 1 )
    {
      v8 = a2 + 12;
      if( (a2[12] & 0x100000) == 0 )
      {
        MiUpControlAreaRefs((_MMVAD_SHORT *)a2);
        v4 = v9;
        if( v9 < 0 )
          break;
      }
      v4 = MiCommitPageTableRangesForVad((const _UNICODE_STRING *)a2, v5, v6);
      if( v4 < 0 )
      {
        v17 = (*v8 & 0x100000) == 0;
LABEL_22:
        if( v17 )
          MiUpControlAreaRefs((_MMVAD_SHORT *)a2);
        break;
      }
      inserted = MiInsertVadCharges((__int64)a2, a1);
      v11 = *v8;
      v4 = inserted;
      if( inserted < 0 )
      {
        v17 = (v11 & 0x100000) == 0;
        goto LABEL_22;
      }
      a2 = *(_DWORD **)a2;
      if( (v11 & 0xC0000) == 0x40000 )
      {
        v12 = *(_QWORD *)(a1 + 1680);
        if( (v11 & 0x100000) != 0 )
          ++*(_QWORD *)(v12 + 424);
        else
          ++*(_QWORD *)(v12 + 432);
      }
      v13 = *v8;
      if( (*v8 & 0x100000) == 0 )
      {
        v14 = (void *)*((_QWORD *)v7 + 16);
        if( v14 )
        {
          ObfReferenceObject(v14);
          v13 = *v8;
        }
        if( (v13 & 0x100000) == 0 && *((__int64 *)v7 + 15) < 0 )
        {
          CurrentThread = (_ETHREAD *)KeGetCurrentThread();
          --*((_WORD *)CurrentThread + 243);
          ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4C6D0, 0i64);
          v16 = *(_QWORD *)(***((_QWORD ***)v7 + 9) + 32i64);
          ++*(_DWORD *)(v16 + 8);
          if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4C6D0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
            ExfTryToWakePushLock((volatile INT64 *)&qword_140C4C6D0);
          KeAbPostRelease(&qword_140C4C6D0);
          KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
        }
      }
      *((_QWORD *)v7 + 2) = -2i64;
      MiGetWsAndInsertVad(v7);
      v7 = a2;
      if( !a2 )
        goto LABEL_25;
    }
    MiDeletePartialCloneVads(a2);
  }
LABEL_25:
  KiUnstackDetachProcess(&ApcState, 0i64);
  return(unsigned int)v4;
}

Referenced by: