MmUpdateUserShadowStackValue

NTSTATUS __stdcall MmUpdateUserShadowStackValue(UINT64 a1, INT64 a2){
  UINT64 v3; 
  _MMVAD_SHORT *v4; 
  int v5; 
  _MMSUPPORT_FULL *p_Vm; 
  INT64 *v7; 
  char v8; 
  char v9; 
  _MMPTE *v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  _MMPFN *v14; 
  volatile signed __int64 *v15; 
  _BOOL4 v16; 
  _MMPTE v17; 
  _MI_PARTITION *v18; 
  UINT64 v19; 
  NTSTATUS v20; 
  UINT64 v21; 
  UINT64 SpinCount[2]; 
  INT64 v24; 
  __int64 v25[8]; 
  char WsIrql; 
  INT64 v28; 

  LODWORD(v28) = 0;
  v24 = 0i64;
  if( (a1 & 7) != 0 )
    ExRaiseDatatypeMisalignment();
  LODWORD(v3) = MiObtainReferencedVadEx(a1, 0, &v28);
  v4 = (_MMVAD_SHORT *)v3;
  SpinCount[1] = v3;
  if( v3 )
  {
    v5 = *(_DWORD *)(v3 + 48);
    if( (v5 & 0x100000) != 0 && (v5 & 0x1000000) == 0 && (v5 & 0x4000000) != 0 )
    {
      p_Vm = &KeGetCurrentThread()->ApcState.Process->Vm;
      v7 = (INT64 *)((char *)MmGetPteBase() + ((a1 >> 9) & 0x7FFFFFFFF8i64));
      while( 1 )
      {
        MiLockWorkingSetShared();
        v9 = v8;
        WsIrql = v8;
        v10 = MiLockLowestValidPageTable((INT64)p_Vm, v7, (INT64 **)&v24);
        LODWORD(v11) = MI_READ_PTE_LOCK_FREE(v24);
        v25[0] = v11;
        if( v10 == (_MMPTE *)((char *)MmGetPteBase() + (((unsigned __int64)v7 >> 9) & 0x7FFFFFFFF8i64))
          && (v11 & 1) != 0 )
        {
          break;
        }
        MiUnlockPageTableInternal((INT64)p_Vm, (UINT64)v10);
        LOBYTE(v21) = v9;
        MiUnlockWorkingSetShared(&p_Vm->Instance, v21);
      }
      LODWORD(v12) = MI_READ_PTE_LOCK_FREE((INT64)v25);
      v13 = (v12 >> 12) & 0xFFFFFFFFFi64;
      v14 = &MmGetPfnDb()[v13];
      LODWORD(SpinCount[0]) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)&v14->u2, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(SpinCount);
        while( v14->u2._bf_0 < 0 );
      }
      v15 = (volatile signed __int64 *)((char *)MiMapPageInHyperSpaceWorker(v13, 0i64, 0x80000000ui64) + (a1 & 0xFFF));
      v16 = a2 == _InterlockedCompareExchange64(v15, 0i64, a2);
      MiUnmapPageInHyperSpaceWorker((VOID *)v15, 0x11u, 0x80000000ui64);
      MiCaptureDirtyBitToPfn();
      if( v17.u.Long )
        v18 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * (((unsigned __int64)v14->u4._bf_0 >> 39) & 0x3FF));
      else
        v18 = 0i64;
      _InterlockedAnd64(&v14->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
      if( v17.u.Long )
        MiReleasePageFileInfo(v18, v17, 1ui64);
      MiUnlockPageTableInternal((INT64)p_Vm, (UINT64)v10);
      LOBYTE(v19) = WsIrql;
      MiUnlockWorkingSetShared(&p_Vm->Instance, v19);
      v20 = !v16 ? 0xC0000272 : 0;
    }
    else
    {
      v20 = -1073741800;
    }
  }
  else
  {
    v20 = v28;
  }
  if( v4 )
    MiUnlockAndDereferenceVad(v4);
  return v20;
}

Referenced by: