MiDuplicateCloneLeaf

UINT64 __stdcall MiDuplicateCloneLeaf(
        MMPTE *PointerPte,
        MMPTE *PointerNewPte,
        UINT64 NewPage,
        UINT8 WsIrql,
        UINT8 PageIrql){
  unsigned __int64 v8; 
  ULONG_PTR v9; 
  char *v10; 
  int v11; 
  unsigned __int64 v12; 
  INT64 *SharedVm; 
  __int64 v15; 
  __int64 v16; 
  UINT64 v17; 
  int v18; 
  UINT64 v19; 
  INT64 TransitionPte; 
  UINT64 v21; 
  unsigned __int64 v22; 
  unsigned __int8 v23; 
  int v24; 
  _ETHREAD *CurrentThread; 
  unsigned int v26; 
  INT64 v27; 
  char PfnPriority; 
  INT64 v29; 
  v8 = MI_READ_PTE_LOCK_FREE((INT64)PointerPte);
  v29 = v8;
  if( (v8 & 1) != 0 )
  {
    v9 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v29) >> 12) & 0xFFFFFFFFFi64;
    v10 = (char *)MmGetPfnDb() + 48 * v9;
    v11 = 1;
    v8 = *((_QWORD *)v10 + 2);
  }
  else
  {
    v12 = v8;
    if( qword_140C4DC80 )
    {
      if( (v8 & 0x10) != 0 )
        v12 = v8 & 0xFFFFFFFFFFFFFFEFui64;
      else
        v12 = v8 & ~qword_140C4DC80;
    }
    v9 = (v12 >> 12) & 0xFFFFFFFFFi64;
    v10 = (char *)MmGetPfnDb() + 48 * v9;
    if( (v10[34] & 0x20) != 0 )
    {
      v27 = *((_QWORD *)KeGetCurrentThread() + 23) + 1664i64;
      _InterlockedAnd64((volatile signed __int64 *)v10 + 3, 0x7FFFFFFFFFFFFFFFui64);
      MiUnlockWorkingSetExclusive(v27, WsIrql);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      ++*((_BYTE *)CurrentThread + 1310);
      --*((_BYTE *)CurrentThread + 1310);
      SharedVm = MiGetSharedVm(v27);
      ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
      *((_DWORD *)SharedVm + 1) = 0;
      return 0i64;
    }
    v11 = 0;
  }
  v15 = (v8 >> 5) & 0x1F;
  v24 = MI_IS_SOFTWARE_PTE_SHADOW_STACK((_QWORD *)v10 + 2);
  v17 = v16 + 48 * NewPage;
  if( v11 != 1 )
    MiLockNestedPageAtDpcInline(v16 + 48 * NewPage);
  v18 = 129;
  if( v11 != 1 )
    v18 = 132;
  MiCopyPage(NewPage, v9, 0i64, v18);
  if( !v11 )
    _InterlockedAnd64((volatile signed __int64 *)(v17 + 24), 0x7FFFFFFFFFFFFFFFui64);
  PfnPriority = MiGetPfnPriority((INT64)v10);
  v26 = (unsigned __int8)v10[34] >> 6;
  if( v11 == 1 )
  {
    TransitionPte = MiMakeTransitionPte(NewPage, (unsigned int)v15, v19);
  }
  else
  {
    _InterlockedAnd64((volatile signed __int64 *)v10 + 3, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(PageIrql);
    TransitionPte = MiUpdateTransitionPteFrame(v29, NewPage);
  }
  v29 = TransitionPte;
  *(_QWORD *)PointerNewPte = TransitionPte;
  v21 = MiVaToPfn(PointerNewPte);
  MiInitializePfnForOtherProcess(NewPage, PointerPte, v21, 0x10ui64);
  *(_QWORD *)(v17 + 16) = *(_QWORD *)(v17 + 16) & 0xFFFFFFFFFFFFFC1Fui64 | (32i64 * (unsigned int)v15);
  v22 = (unsigned __int8)MiLockPageInline(v17);
  if( v24 )
    *(_QWORD *)(v17 + 16) |= 0x4000000ui64;
  v23 = *(_BYTE *)(v17 + 34);
  if( v23 >> 6 != v26 )
  {
    MiChangePageAttribute(v17, v26, 3);
    v23 = *(_BYTE *)(v17 + 34);
  }
  *(_BYTE *)(v17 + 35) ^= (PfnPriority ^ *(_BYTE *)(v17 + 35)) & 7;
  *(_BYTE *)(v17 + 34) = v23 & 0xF8 | 6;
  MiDecrementShareCount(v17);
  _InterlockedAnd64((volatile signed __int64 *)(v17 + 24), 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(v22);
  return 1i64;
}

Referenced by: