MiCloneCaptureVadCommit

INT64 __fastcall MiCloneCaptureVadCommit(INT64 a1){
  _QWORD *v2; 
  _QWORD *v3; 
  __int64 *v5; 
  int v6; 
  _MMPTE *PteBase; 
  INT64 v8; 
  unsigned __int64 v9; 
  INT64 *SharedVm; 
  KIRQL v11; 
  KIRQL v12; 
  unsigned __int64 v13; 
  __int64 v14; 
  unsigned __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  unsigned __int64 v19; 
  _QWORD *v20; 
  INT64 *v21; 
  UINT8 v22; 
  int a6; 
  INT64 a2; 
  a6 = 0;
  LODWORD(v2) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
  v3 = v2;
  if( !v2 )
    return 3221225626i64;
  *v2 = 0i64;
  v5 = v2 + 1;
  v2[1] = 0i64;
  v6 = 0;
  PteBase = MmGetPteBase();
  v8 = *((_QWORD *)KeGetCurrentThread() + 23) + 1664i64;
  v9 = (unsigned __int64)PteBase
     + 8 * ((*(unsigned int *)(a1 + 24) | ((unsigned __int64)*(unsigned __int8 *)(a1 + 32) << 32)) & 0xFFFFFFFFFi64);
  a2 = (INT64)PteBase
     + 8 * ((*(unsigned int *)(a1 + 28) | ((unsigned __int64)*(unsigned __int8 *)(a1 + 33) << 32)) & 0xFFFFFFFFFi64);
  SharedVm = MiGetSharedVm(v8);
  v11 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
  *((_DWORD *)SharedVm + 1) = 0;
  v12 = v11;
  v13 = a2;
  v22 = v11;
  while( v9 <= v13 )
  {
    MiGetNextPageTable(v9, v13, 0i64, v12, 4, &a6);
    if( !v14 )
      break;
    v15 = v14 & 0xFFFFFFFFFFFFF000ui64;
    v16 = *v5;
    v17 = (__int64)(((v14 & 0xFFFFFFFFFFFFF000ui64) << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
    if( *v5
      && (v18 = v3[v16 + 1], v19 = v18 & 0x1FFFFF, v19 + 1 > v19)
      && v19 != 0x1FFFFF
      && (v18 & 0xFFFFFFFFFFE00000ui64) + ((v19 + 1) << 21) == v17 )
    {
      v3[v16 + 1] = v18 & 0xFFFFFFFFFFE00000ui64 | (v18 + 1) & 0x1FFFFF;
    }
    else
    {
      if( v16 == 16 )
      {
        MiUnlockWorkingSetExclusive(v8, v22);
        LODWORD(v20) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
        if( !v20 )
        {
          v6 = -1073741670;
          goto LABEL_18;
        }
        v5 = v20 + 1;
        *v20 = v3;
        v20[1] = 0i64;
        v3 = v20;
        v21 = MiGetSharedVm(v8);
        ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v21);
        *((_DWORD *)v21 + 1) = 0;
        v16 = *v5;
        v13 = a2;
      }
      v3[v16 + 2] = v17;
      ++*v5;
    }
    v12 = v22;
    v9 = v15 + 4096;
  }
  MiUnlockWorkingSetExclusive(v8, v12);
LABEL_18:
  *(_QWORD *)(a1 + 8) = v3;
  if( v6 < 0 )
    MiCloneDiscardVadCommit(a1);
  return(unsigned int)v6;
}

Referenced by: