MiInitializeProcessTopDownEntropy

VOID __stdcall MiInitializeProcessTopDownEntropy(_EPROCESS *NewProcess, _SECTION *Section, UINT8 ExecutableMapped){
  unsigned __int64 v3; 
  unsigned __int64 v5; 
  unsigned __int64 v6; 
  _QWORD *v7; 
  v3 = *((_QWORD *)NewProcess + 187);
  if( v3 > 0x100000000i64 )
    v3 = 0i64;
  v5 = v3;
  v6 = (-(__int64)(Section != 0i64) & 0xFFFFFFF600010000ui64) + 0x7FFFFFFF0000i64;
  if( (*((_DWORD *)NewProcess + 628) & 0x40) == 0 )
  {
    if( v3 )
      v5 = v3 - ((unsigned __int8)ExGenRandom(1i64) << 16);
    v6 -= (unsigned int)ExGenRandom(1i64) << 16;
  }
  v7 = (_QWORD *)*((_QWORD *)NewProcess + 210);
  if( v5 )
    v7[30] = v6;
  else
    v5 = v6;
  v7[12] = v5;
  v7[21] = v5;
}

Referenced by: