MiSwitchBaseAddress

VOID __stdcall MiSwitchBaseAddress(_CONTROL_AREA *ControlArea, PVOID NewBase, _MMPTE *MappingPte, UINT64 SessionId){
  __int64 v4; 
  _MMPTE *v5; 
  __int64 v7; 
  char *v8; 
  __int64 v9; 
  __int64 i; 
  __int64 v11; 
  __int64 v12; 
  __int64 *v13; 
  __int64 v14; 
  __int64 *v15; 
  v4 = *(_QWORD *)ControlArea;
  v5 = MappingPte;
  v7 = *(_QWORD *)(*((_QWORD *)ControlArea + 12) + 32i64);
  v8 = (char *)NewBase - *(_QWORD *)(*(_QWORD *)ControlArea + 32i64);
  v9 = *(_QWORD *)(v7 + 40);
  *(_QWORD *)(v7 + 40) = v8;
  *(_QWORD *)(v4 + 32) = NewBase;
  **(_QWORD **)(v4 + 56) += *(_QWORD *)(v7 + 40);
  for( i = *(_QWORD *)(v7 + 16); i; i = *v13 )
    MiApplyBytestreamFixup((__int64)ControlArea, (_QWORD *)(i + 24), v9);
  MiWalkEntireImage((ULONG_PTR)ControlArea, (unsigned __int64)v5, 2, SessionId);
  *(_QWORD *)(v7 + 40) = &v8[v9];
  v12 = *(_QWORD *)(v7 + 16);
  if( v12 )
  {
    v14 = -v9;
    do
    {
      MiApplyBytestreamFixup(v11, (_QWORD *)(v12 + 24), v14);
      v12 = *v15;
    }
    while( v12 );
  }
  if( (*(_WORD *)(v4 + 12) & 0x2000) != 0 )
  {
    DbgUnLoadImageSymbolsUnicode(
      (UNICODE_STRING *)((*((_QWORD *)ControlArea + 8) & 0xFFFFFFFFFFFFFFF0ui64) + 88),
      *(PVOID *)(v4 + 32),
      *((_QWORD *)KeGetCurrentThread() + 23));
    *(_WORD *)(v4 + 12) &= ~0x2000u;
  }
}

Referenced by: