MiCommitVadCfgBits

INT64 __fastcall MiCommitVadCfgBits(INT64 a1, INT64 a2, UINT8 *a3){
  _SEGMENT *v4; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  void *v8; 
  INT64 a5; 
  _SEGMENT ***v10; 
  _SEGMENT **v11; 
  __int64 v12; 
  __int16 v13; 
  bool v14; 
  unsigned int v15; 
  INT64 a6; 
  INT64 v17; 
  INT64 v18; 
  INT64 v19; 
  INT64 result; 
  __int64 v21; 
  __int16 v22; 
  __int16 v23; 
  char v24; 
  v24 = 0;
  v4 = 0i64;
  v5 = *((_QWORD *)KeGetCurrentThread() + 23);
  if( !MiIsProcessCfgEnabled() )
    return 0i64;
  v8 = (void *)((*(unsigned int *)(v7 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v7 + 32) << 32)) << 12);
  a5 = ((*(unsigned int *)(v7 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v7 + 33) << 32)) << 12) + 4096;
  if( v6 )
  {
    v8 = *(void **)v6;
    a5 = (*(_QWORD *)(v6 + 8) | 0xFFFi64) + 1;
  }
  else if( (*(_DWORD *)(v7 + 48) & 0x100000) == 0 )
  {
    v10 = *(_SEGMENT ****)(v7 + 72);
    v11 = *v10;
    if( ((_DWORD)(*v10)[7] & 0x20) != 0 )
    {
      v4 = *v11;
      v23 = *(_WORD *)(*((_QWORD *)*v11 + 7) + 48i64);
      v12 = *(_QWORD *)(v5 + 1408);
      if( !v12 || (v13 = *(_WORD *)(v12 + 8)) == 0 )
        v13 = -31132;
      v14 = v23 == -31132;
      if( v23 == v13 )
        v14 = 1;
      if( !v14 )
        a3 = (UINT8 *)&v24;
    }
  }
  MiSelectCfgBitMap((_EPROCESS *)v5, v8, v4);
  v17 = a6;
  result = MiMarkProcessCfgBits(v15, v18, v19, (INT64)v8, a5, a6, (INT64)a3);
  v21 = *(_QWORD *)(v5 + 1408);
  if( v21 )
  {
    v22 = *(_WORD *)(v21 + 8);
    if( (v22 == 332 || v22 == 452)
      && (int)result >= 0
      && (v17 != *(_QWORD *)(v5 + 1680) + 440i64 || (unsigned __int64)v8 <= 0x100000000i64) )
    {
      MiMarkPrivateOpenCfgBits();
    }
  }
  return result;
}

Referenced by: