MiEmptyWorkingSetInitiate

NTSTATUS __fastcall MiEmptyWorkingSetInitiate(INT64 rcx0, INT8 a2, INT64 a3, INT64 a4){
  int v8; 
  int v9; 
  UINT64 v10; 
  bool v11; 
  char v12; 
  NTSTATUS v13; 
  INT64 v15[22]; 
  __int64 v16[24]; 

  memset(v16, 0i64, sizeof(v16));
  memset(v15, 0i64, sizeof(v15));
  v8 = 0;
  LODWORD(v16[1]) = MiTbFlushType((_MMSUPPORT_INSTANCE *)rcx0);
  v15[21] = (INT64)v16;
  LOWORD(v15[0]) = 6;
  v15[19] = (INT64)MiEmptyPte;
  v15[20] = (INT64)MiEmptyWorkingSetTail;
  v9 = v16[0];
  WORD2(v16[1]) = 4;
  v16[3] = 0i64;
  LODWORD(v16[2]) = 20;
  v16[4] = 0i64;
  v15[3] = rcx0;
  if( (a2 & 1) != 0 )
  {
    v9 = LODWORD(v16[0]) | 1;
  }
  else
  {
    if( (a2 & 2) == 0 )
      goto LABEL_5;
    v9 = LODWORD(v16[0]) | 2;
  }
  LODWORD(v16[0]) = v9;
LABEL_5:
  if( (a2 & 4) != 0 )
    LODWORD(v16[0]) = v9 | 4;
  v15[4] = a3;
  v15[5] = a4;
  MiLockWorkingSetShared();
  v11 = (*(_BYTE *)(rcx0 + 184) & 7) == 0;
  BYTE6(v15[0]) = v12;
  if( v11 && (KeGetCurrentThread()->ApcState.Process->Flags & 0x20) != 0 )
  {
    v13 = -1073741558;
  }
  else
  {
    if( MiWalkPageTables((INT64)v15) == 4 )
      v8 = -1073741558;
    v13 = v8;
  }
  LOBYTE(v10) = BYTE6(v15[0]);
  MiUnlockWorkingSetShared((_MMSUPPORT_INSTANCE *)rcx0, v10);
  return v13;
}

Referenced by: