MiMakeProtoPrivate

INT64 __fastcall MiMakeProtoPrivate(INT64 a1, UINT8 a2, UINT64 a3){
  unsigned int v4; 
  __int64 v5; 
  char *v8; 
  unsigned __int64 CloneAddress; 
  __int64 v10; 
  _MMPTE *PteBase; 
  int v12; 
  INT64 v14; 
  v4 = 0;
  v5 = 0i64;
  v14 = MI_READ_PTE_LOCK_FREE(a3);
  v8 = (char *)MmGetPfnDb() + 48 * (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v14) >> 12) & 0xFFFFFFFFFi64);
  if( (*((_QWORD *)v8 + 5) & 0x1000000000i64) != 0 || *((__int64 *)v8 + 1) <= 0 )
  {
    CloneAddress = (unsigned __int64)MiLocateCloneAddress(
                                       *((_QWORD *)KeGetCurrentThread() + 23),
                                       *((_QWORD *)v8 + 1) | 0x8000000000000000ui64);
    v5 = CloneAddress & -(__int64)(*(_QWORD *)(CloneAddress + 96) < *(_QWORD *)(*(_QWORD *)(v10 + 1680) + 360i64));
  }
  PteBase = MmGetPteBase();
  v12 = MiCopyOnWrite((__int64)((a3 << 25) - ((_QWORD)PteBase << 25)) >> 16, (UINT64 *)a3, -1i64, 0i64);
  if( v12 >= 0 )
  {
    LOBYTE(v4) = v5 != 0;
    return v4;
  }
  else
  {
    MiUnlockPageTableInternal(a1, (UINT64)PteBase + ((a3 >> 9) & 0x7FFFFFFFF8i64));
    MiUnlockWorkingSetShared(a1, a2);
    MiCopyOnWriteCheckConditions(a1, (unsigned int)v12);
    return 2i64;
  }
}

Referenced by: