KiSwapProcess

VOID __stdcall KiSwapProcess(_EPROCESS *NewProcess, _EPROCESS *OldProcess){
  struct _KPRCB *CurrentPrcb; 
  unsigned __int64 GroupIndex; 
  __int64 v5; 
  unsigned __int64 DirectoryTableBase; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 

  CurrentPrcb = KeGetCurrentPrcb();
  GroupIndex = CurrentPrcb->GroupIndex;
  v5 = 8i64 * CurrentPrcb->Group + 376;
  _interlockedbittestandset64((volatile signed __int32 *)&NewProcess->Pcb.gap0[v5], GroupIndex);
  DirectoryTableBase = NewProcess->Pcb.DirectoryTableBase;
  if( KiKvaShadow )
  {
    v7 = NewProcess->Pcb.DirectoryTableBase;
    if( (DirectoryTableBase & 2) != 0 )
      v7 = DirectoryTableBase | 0x8000000000000000ui64;
    __writegsqword(0x9000u, v7);
    KiSetAddressPolicy(NewProcess->Pcb.AddressPolicy);
  }
  __writecr3(DirectoryTableBase);
  if( !KiFlushPcid && KiKvaShadow )
  {
    v8 = __readcr4();
    if( (v8 & 0x20080) != 0 )
    {
      __writecr4(v8 ^ 0x80);
      __writecr4(v8);
    }
    else
    {
      v9 = __readcr3();
      __writecr3(v9);
    }
  }
  _interlockedbittestandreset64((volatile signed __int32 *)&OldProcess->Pcb.gap0[v5], GroupIndex);
}

Referenced by: