MmUpdateUserShadowStackValue

INT64 __fastcall MmUpdateUserShadowStackValue(UINT64 a1, INT64 a2){
  INT64 v3; 
  void *v4; 
  int v5; 
  INT64 v6; 
  INT64 *v7; 
  UINT8 v8; 
  _MMPTE *v9; 
  INT64 v10; 
  unsigned __int64 v11; 
  char *v12; 
  __int64 v13; 
  volatile signed __int64 *v14; 
  BOOL v15; 
  UINT64 v16; 
  INT64 v17; 
  INT64 v18; 
  unsigned int v19; 
  UINT64 SpinCount; 
  INT64 v22; 
  INT64 v23; 
  __int64 v24[8]; 
  UINT8 v26; 
  INT64 v27; 
  LODWORD(v27) = 0;
  v23 = 0i64;
  if( (a1 & 7) != 0 )
    ExRaiseDatatypeMisalignment();
  v3 = MiObtainReferencedVadEx(a1, 0, &v27);
  v4 = (void *)v3;
  v22 = v3;
  if( v3 )
  {
    v5 = *(_DWORD *)(v3 + 48);
    if( (v5 & 0x100000) != 0 && (v5 & 0x1000000) == 0 && (v5 & 0x4000000) != 0 )
    {
      v6 = *((_QWORD *)KeGetCurrentThread() + 23) + 1664i64;
      v7 = (INT64 *)((char *)MmGetPteBase() + ((a1 >> 9) & 0x7FFFFFFFF8i64));
      while( 1 )
      {
        v8 = MiLockWorkingSetShared(v6);
        v26 = v8;
        v9 = MiLockLowestValidPageTable(v6, v7, (INT64 **)&v23);
        v10 = MI_READ_PTE_LOCK_FREE(v23);
        v24[0] = v10;
        if( v9 == (_MMPTE *)((char *)MmGetPteBase() + (((unsigned __int64)v7 >> 9) & 0x7FFFFFFFF8i64))
          && (v10 & 1) != 0 )
        {
          break;
        }
        MiUnlockPageTableInternal(v6, (UINT64)v9);
        MiUnlockWorkingSetShared(v6, v8);
      }
      v11 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)v24) >> 12) & 0xFFFFFFFFFi64;
      v12 = (char *)MmGetPfnDb() + 48 * v11;
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)v12 + 6, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( *((__int64 *)v12 + 3) < 0 );
      }
      LODWORD(v13) = MiMapPageInHyperSpaceWorker(v11, 0i64, 0x80000000ui64);
      v14 = (volatile signed __int64 *)((a1 & 0xFFF) + v13);
      v15 = a2 == _InterlockedCompareExchange64(v14, 0i64, a2);
      MiUnmapPageInHyperSpaceWorker((PVOID)v14, 0x11u, 0x80000000ui64);
      v16 = MiCaptureDirtyBitToPfn((INT64)v12);
      if( v16 )
        v18 = *(_QWORD *)(qword_140C4E388 + 8 * ((*((_QWORD *)v12 + 5) >> 39) & 0x3FFi64));
      else
        v18 = 0i64;
      _InterlockedAnd64((volatile signed __int64 *)v12 + 3, 0x7FFFFFFFFFFFFFFFui64);
      if( v16 )
        MiReleasePageFileInfo(v18, v16, 1, v17, SpinCount, v22, v23, v24[0], v24[1], v24[2], v24[3], v24[4]);
      MiUnlockPageTableInternal(v6, (UINT64)v9);
      MiUnlockWorkingSetShared(v6, v26);
      v19 = !v15 ? 0xC0000272 : 0;
    }
    else
    {
      v19 = -1073741800;
    }
  }
  else
  {
    v19 = v27;
  }
  if( v4 )
    MiUnlockAndDereferenceVad(v4);
  return v19;
}

Referenced by: