MmCreateMirror

NTSTATUS __stdcall MmCreateMirror(){
  char PreviousMode; 
  _UNICODE_STRING ValueName; 
  _MM_MIRROR_DISPATCH MirrorDispatch[2]; 
  __int64(__fastcall *v4)(); 
  __int64(__fastcall *v5)(); 
  unsigned __int64 v6; 
  int v7; 
  int v8; 
  int Data; 
  UINT64 ResultDataSize; 
  UINT64 Type; 

  v8 = 0;
  LODWORD(Type) = 0;
  Data = 0;
  ValueName.Buffer = L"Kernel-MemoryMirroringSupported";
  *(_QWORD *)&ValueName.Length = 4194366i64;
  LODWORD(ResultDataSize) = 4;
  if( ZwQueryLicenseValue(&ValueName, &Type, &Data, 4ui64, &ResultDataSize) < 0 || Data != 1 )
    return -1073741206;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode && !SeSinglePrivilegeCheck(*(_QWORD *)&SeShutdownPrivilege, PreviousMode) )
    return -1073741727;
  if( (dword_140CFA184 & 1) == 0 )
    return -1073741637;
  *(__int64(__fastcall **)())MirrorDispatch = off_140C00AE0[0];
  v4 = off_140C00AE8[0];
  v5 = off_140C00AF0[0];
  v6 = (unsigned __int64)off_140C00B00 & -(__int64)((dword_140CFA184 & 2) != 0);
  v7 = 2;
  return MmDuplicateMemory(MirrorDispatch);
}

Referenced by: