MiInitializeVadBitMap
UINT64 __stdcall MiInitializeVadBitMap(UINT64 ProcessIsClone){
_ETHREAD *CurrentThread;
unsigned int v2;
int v3;
__int64 v4;
__int64 v5;
__int64 v6;
__int64 *i;
unsigned __int64 v8;
int v9;
int v10;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v2 = 0;
v3 = ProcessIsClone;
v4 = 0i64;
v5 = *((_QWORD *)CurrentThread + 23);
v6 = *(_QWORD *)(v5 + 1680);
if( *(_QWORD *)(v6 + 264) )
{
for( i = (__int64 *)(v6 + 64); ; i += 9 )
{
v8 = (unsigned __int64)i[6] >> 15 << 12;
*i = i[6] & 0x7FFF;
*(i - 1) = qword_140C4E0A0 + 4 * (v8 >> 2);
if( v3 == 1 )
*(i - 2) = 0i64;
LOCK_ADDRESS_SPACE((__int64)CurrentThread, v5);
MiExpandVadBitMap();
v10 = v9;
i[2] = *i;
UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, v5);
if( !v10 )
break;
if( (unsigned __int64)++v4 >= *(_QWORD *)(v6 + 264) )
return v2;
}
return(unsigned int)-1073741801;
}
return v2;
}Referenced by:
MmInitializeProcessAddressSpace