MiInitializeWowPeb

NTSTATUS __fastcall MiInitializeWowPeb(__int64 a1, __int64 a2, INT64 a3, __int64 a4){
  __int64 v8; 
  __int16 v9; 
  NTSTATUS result; 
  _WORD *v11; 
  _WORD *v12; 
  __int64 v13; 
  int v14; 
  __int16 v15; 
  char v16; 
  UINT64 v17; 
  _DWORD *v18; 
  __int64 v19; 
  __int16 v20; 
  unsigned __int64 v21; 
  __int64 v22; 
  __int16 v23; 
  int v24; 
  char Size[12]; 
  VOID *Base; 

  Base = 0i64;
  *(_QWORD *)&Size[4] = 0i64;
  v8 = *(_QWORD *)(a3 + 1408);
  if( v8 && ((v9 = *(_WORD *)(v8 + 8), v9 == 332) || v9 == 452) )
  {
    result = MmCheckImageMapping(a3);
    if( result < 0 )
      return result;
    v11 = RtlImageDirectoryEntryToData(*(VOID **)(a3 + 1312), 0, 0xAu, (UINT64 *)Size);
    v12 = v11;
    *(_QWORD *)&Size[4] = v11;
    if( v11 )
    {
      if( ((unsigned __int8)v11 & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v13 = *(unsigned int *)(*(_QWORD *)&Size[4] + 48i64);
      if( ((unsigned int)v13 & KeActiveProcessors.Bitmap[*(unsigned __int16 *)(a4 + 8)]) != v13 )
        v13 = 0i64;
      *(_QWORD *)a4 = v13;
      v12 = *(_WORD **)&Size[4];
    }
    *(_DWORD *)a1 = *(unsigned __int16 *)(a2 + 92);
    *(_DWORD *)(a1 + 4) = *(unsigned __int16 *)(a2 + 72);
    *(_DWORD *)(a1 + 8) = *(unsigned __int16 *)(a2 + 74);
    v14 = *(_DWORD *)(a2 + 76);
    if( v14 )
    {
      if( v12 )
      {
        v15 = v12[26];
        if( v15 )
        {
          *(_WORD *)(a1 + 26) = v15;
          v14 = *(_DWORD *)(a2 + 76);
        }
      }
      *(_DWORD *)(a1 + 12) = (unsigned __int8)v14;
      *(_DWORD *)(a1 + 16) = BYTE1(v14);
      *(_WORD *)(a1 + 24) = HIWORD(v14);
      *(_DWORD *)(a1 + 20) = (v14 ^ 0xBFFFFFFF) >> 30;
    }
    v16 = 1;
    v17 = 1i64;
  }
  else
  {
    v17 = 2i64;
    v16 = 1;
  }
  result = MiCreatePebOrTeb(v17, 0i64, &Base);
  if( result >= 0 )
  {
    v18 = Base;
    **(_QWORD **)(a3 + 1408) = Base;
    v19 = *(_QWORD *)(a3 + 1408);
    if( v19 )
    {
      v20 = *(_WORD *)(v19 + 8);
      if( v20 == 332 || v20 == 452 )
      {
        v21 = *(_QWORD *)(a1 + 32);
        if( v21 > 0x40000000 )
        {
          v21 = 0x100000i64;
          *(_QWORD *)(a1 + 32) = 0x100000i64;
        }
        if( *(_QWORD *)(a1 + 40) > v21 )
          *(_QWORD *)(a1 + 40) = 0x2000i64;
      }
    }
    v22 = *(_QWORD *)(a3 + 1408);
    if( !v22 || (v23 = *(_WORD *)(v22 + 8), v23 != 332) && v23 != 452 )
      v16 = 0;
    v24 = *(_DWORD *)(a1 + 12);
    if( v16 )
    {
      v18[41] = v24;
      v18[42] = *(_DWORD *)(a1 + 16);
      *((_WORD *)v18 + 86) = *(_WORD *)(a1 + 24);
      v18[44] = *(_DWORD *)(a1 + 20);
      *((_WORD *)v18 + 87) = *(_WORD *)(a1 + 26);
      v18[30] = *(_DWORD *)(a1 + 32);
      v18[31] = *(_DWORD *)(a1 + 40);
      v18[25] = KeNumberProcessors_0;
      v18[26] = NtGlobalFlag;
      v18[286] = NtGlobalFlag2;
      *((_QWORD *)v18 + 14) = *(&stru_140C4DB30 + 6);
      v18[130] = dword_140CFA198;
      v18[32] = qword_140CFA1A8;
      v18[33] = qword_140CFA1A0;
      v18[117] = *(_DWORD *)(a1 + 60);
      v18[45] = *(_DWORD *)a1;
      v18[46] = *(_DWORD *)(a1 + 4);
      v18[47] = *(_DWORD *)(a1 + 8);
      *(_BYTE *)v18 = *(_BYTE *)(a1 + 96);
      *((_BYTE *)v18 + 3) = *(_BYTE *)(a1 + 97);
      v18[1] = *(_DWORD *)(a1 + 104);
      v18[2] = *(_DWORD *)(a1 + 112);
      v18[22] = *(_DWORD *)(a1 + 120);
      v18[23] = *(_DWORD *)(a1 + 128);
      v18[24] = *(_DWORD *)(a1 + 136);
      v18[284] = *(_DWORD *)(a1 + 144);
      v18[285] = *(_DWORD *)(a1 + 152);
    }
    else
    {
      v18[70] = v24;
      v18[71] = *(_DWORD *)(a1 + 16);
      *((_WORD *)v18 + 144) = *(_WORD *)(a1 + 24);
      v18[73] = *(_DWORD *)(a1 + 20);
      *((_WORD *)v18 + 145) = *(_WORD *)(a1 + 26);
      *((_QWORD *)v18 + 25) = *(_QWORD *)(a1 + 32);
      *((_QWORD *)v18 + 26) = *(_QWORD *)(a1 + 40);
      v18[46] = KeNumberProcessors_0;
      v18[47] = NtGlobalFlag;
      v18[497] = NtGlobalFlag2;
      *((_QWORD *)v18 + 24) = *(&stru_140C4DB30 + 6);
      *((_QWORD *)v18 + 99) = (unsigned int)dword_140CFA198;
      *((_QWORD *)v18 + 27) = qword_140CFA1A8;
      *((_QWORD *)v18 + 28) = qword_140CFA1A0;
      v18[176] = *(_DWORD *)(a1 + 60);
      v18[74] = *(_DWORD *)a1;
      v18[75] = *(_DWORD *)(a1 + 4);
      v18[76] = *(_DWORD *)(a1 + 8);
      *(_BYTE *)v18 = *(_BYTE *)(a1 + 96);
      *((_BYTE *)v18 + 3) = *(_BYTE *)(a1 + 97);
      *((_QWORD *)v18 + 1) = *(_QWORD *)(a1 + 104);
      *((_QWORD *)v18 + 2) = *(_QWORD *)(a1 + 112);
      *((_QWORD *)v18 + 20) = *(_QWORD *)(a1 + 120);
      *((_QWORD *)v18 + 21) = *(_QWORD *)(a1 + 128);
      *((_QWORD *)v18 + 22) = *(_QWORD *)(a1 + 136);
      *((_QWORD *)v18 + 247) = *(_QWORD *)(a1 + 144);
      v18[496] = *(_DWORD *)(a1 + 152);
    }
    return 0;
  }
  return result;
}

Referenced by: