MiUpdateForkMaps

INT64 __fastcall MiUpdateForkMaps(INT64 *a1, INT64 a2, INT64 a3, INT64 a4, INT64 CurrentProcess, CHAR WsIrql){
  __int64 v8; 
  unsigned __int64 v9; 
  _MMPTE *PteBase; 
  __int64 v12; 
  __int64 v13; 
  __int64 v14; 
  INT64 v15; 
  INT64 v16; 
  MMPTE **v17; 
  int v18; 
  UINT64 v19; 
  UINT64 MakeValid; 
  char *v21; 
  __int64 v22; 
  UINT64 v23; 
  INT64 v24; 
  unsigned __int64 v25; 
  INT64 *v26; 
  CHAR v27; 
  UINT64 v28; 
  __int64 v29; 
  __int64 v30; 
  UINT64 v31[2]; 
  __int128 v32; 
  int v33; 
  _QWORD *v34; 
  v34 = (_QWORD *)a4;
  v33 = 0;
  *(_OWORD *)v31 = 0i64;
  v32 = 0i64;
  MiGetNextPageTable(a2, a3, 0i64, WsIrql, 4, &v33);
  v30 = v8;
  v9 = v8;
  if( !v8 )
    return a3 + 8;
  PteBase = MmGetPteBase();
  v12 = ((v8 << 25) - ((_QWORD)PteBase << 25)) >> 16;
  LODWORD(v13) = MI_IS_PHYSICAL_ADDRESS((PVOID)v12);
  if( (_DWORD)v13 )
  {
    v14 = (unsigned int)v13;
    do
    {
      v9 = (unsigned __int64)PteBase + ((v9 >> 9) & 0x7FFFFFFFF8i64);
      --v14;
    }
    while( v14 );
    v9 += 8i64;
    v13 = (unsigned int)v13;
    do
    {
      v9 = (__int64)((v9 << 25) - ((_QWORD)PteBase << 25)) >> 16;
      --v13;
    }
    while( v13 );
  }
  else
  {
    if( ((v9 ^ a1[6]) & 0xFFFFFFFFFFFFF000ui64) != 0 )
    {
      MiFillPteHierarchy(v12, v31);
      v16 = *a1;
      v17 = (MMPTE **)&v32 + 1;
      a1[6] = v9;
      v18 = 4;
      v29 = 3i64;
      v19 = *(_QWORD *)(v16 + 40) >> 12;
      MakeValid = v19;
      v21 = 0i64;
      do
      {
        LODWORD(v22) = MiMapSinglePage((PVOID)a1[7], v19, 0x40000020ui64);
        v23 = v22 + 8i64 * ((*(_DWORD *)v17 >> 3) & 0x1FF);
        v24 = MI_READ_PTE_LOCK_FREE(v23);
        v28 = v24;
        v25 = v24;
        if( v24 )
        {
          if( (v24 & 1) != 0 )
          {
            MiPteInShadowRange((UINT64)&v28);
          }
          else if( qword_140C4DC80 )
          {
            if( (v24 & 0x10) != 0 )
              v25 = v24 & 0xFFFFFFFFFFFFFFEFui64;
            else
              v25 = ~qword_140C4DC80 & v24;
          }
          v19 = (v25 >> 12) & 0xFFFFFFFFFi64;
        }
        else
        {
          v26 = &a1[4 - v18];
          MiDoneWithThisPageGetAnother(v26 + 1, CurrentProcess, *a1, WsIrql);
          v19 = v26[1];
          MiBuildForkPageTable(*a1, (MMPTE *)v19, *v17, v23, MakeValid);
          ++*v34;
          if( v21 )
            MiIncreaseUsedPtesCount(v21, 1ui64);
        }
        v21 = (char *)MmGetPfnDb() + 48 * v19;
        --v18;
        --v17;
        MakeValid = v19;
        --v29;
      }
      while( v29 );
      LODWORD(v15) = MiMapSinglePage((PVOID)a1[7], v19, 0x40000020ui64);
      v9 = v30;
      a1[4] = v15;
      a1[8] = (INT64)v21;
    }
    else
    {
      v15 = a1[4];
    }
    v27 = WsIrql;
    a1[5] = v15 | v9 & 0xFFF;
    MiMakeSystemAddressValid(v9, 0i64, 0i64, v27, 1);
  }
  return v9;
}

Referenced by: