HvpViewMapMakeViewRangeUnCOWByPolicy
VOID __fastcall HvpViewMapMakeViewRangeUnCOWByPolicy(BOOL *a1){
_QWORD *v1;
__int64 v2;
__int64 v3;
__int64 v4;
__int64 v5;
_QWORD *v6;
__int64 v8;
unsigned __int64 v9;
VOID *v10;
char v11;
char v12;
UINT64 NewAccessProtection;
INT64 a6;
if( v2 < v3 )
{
LODWORD(a6) = 0;
v4 = v3;
v5 = v2;
v6 = v1;
do
{
v8 = v6[3];
v9 = (unsigned __int64)(v5 - v8) >> 12;
v10 = (VOID *)(v6[7] + v5 - v8);
v11 = *((_BYTE *)v6 + v9 + 72);
if( (v11 & 0x10) != 0 )
{
CmSiUnlockViewOfSection((UINT64)a1, *((VOID ***)a1 + 3), v10, 0x1000ui64);
*((_BYTE *)v6 + v9 + 72) &= ~0x10u;
--v6[8];
v11 = *((_BYTE *)v6 + v9 + 72);
}
if( (v11 & 4) != 0 )
{
v12 = v11 & 0xFB;
*((_BYTE *)v6 + v9 + 72) = v12;
if( (v12 & 2) == 0 )
{
LODWORD(NewAccessProtection) = -2147483646;
CmSiProtectViewOfSection((UINT64)a1, *((VOID ***)a1 + 3), v10, 0x1000ui64, NewAccessProtection, (INT64)&a6);
}
}
v5 += 4096i64;
}
while( v5 < v4 );
}
}Referenced by:
HvpViewMapAdjustFlag