MiCreateCloneChain

__int64 __fastcall MiCreateCloneChain(__int64 a1, _QWORD *a2){
  _ETHREAD *CurrentThread; 
  int v4; 
  _QWORD *v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  INT64 *SharedVm; 
  KIRQL v9; 
  UINT8 v10; 
  _QWORD *v11; 
  _QWORD *i; 
  _QWORD *v13; 
  _QWORD **v14; 
  _QWORD *v15; 
  _QWORD *v16; 
  _QWORD *v17; 
  __int64 result; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *a2 = 0i64;
  v4 = 0;
  v5 = 0i64;
  v6 = 0i64;
  v7 = *((_QWORD *)CurrentThread + 23);
  SharedVm = MiGetSharedVm(v7 + 1664);
  v9 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
  *((_DWORD *)SharedVm + 1) = 0;
  v10 = v9;
  v11 = *(_QWORD **)(v7 + 1264);
  i = 0i64;
  while( v11 )
  {
    i = v11;
    v11 = (_QWORD *)*v11;
  }
  while( i )
  {
    if( i[6] )
    {
      LODWORD(v13) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
      if( !v13 )
      {
        v4 = -1073741670;
        break;
      }
      *v13 = v5;
      v5 = v13;
      v13[8] = i[8];
      v6 += i[8];
    }
    v14 = (_QWORD **)i[1];
    v15 = i;
    if( v14 )
    {
      v16 = *v14;
      for( i = (_QWORD *)i[1]; v16; v16 = (_QWORD *)*v16 )
        i = v16;
    }
    else
    {
      while( 1 )
      {
        i = (_QWORD *)(i[2] & 0xFFFFFFFFFFFFFFFCui64);
        if( !i || (_QWORD *)*i == v15 )
          break;
        v15 = i;
      }
    }
  }
  MiUnlockWorkingSetExclusive(v7 + 1664, v10);
  if( v4 < 0 )
    goto LABEL_22;
  if( v6 )
    v4 = PsChargeProcessNonPagedPoolQuota(a1, v6);
  if( v4 < 0 )
  {
LABEL_22:
    if( v5 )
    {
      do
      {
        v17 = (_QWORD *)*v5;
        ExFreePoolWithTag(v5, 0);
        v5 = v17;
      }
      while( v17 );
    }
    v5 = 0i64;
  }
  result = (unsigned int)v4;
  *a2 = v5;
  return result;
}

Referenced by: