MmDuplicateMemory

NTSTATUS __stdcall MmDuplicateMemory(_MM_MIRROR_DISPATCH *MirrorDispatch){
  _MM_MIRROR_DISPATCH v1; 
  unsigned __int8 CurrentIrql; 
  unsigned __int8 v4; 
  NTSTATUS result; 
  int v6; 
  _ETHREAD *CurrentThread; 
  INT16 v8; 
  INT64 v9; 
  int v10; 
  int v11; 
  unsigned __int8 v12; 
  int v13; 
  INT64 v14[2]; 
  __int64 v15; 
  __int64 v16; 

  v1 = MirrorDispatch[8];
  v16 = 0i64;
  v15 = 0i64;
  CurrentIrql = 17;
  v4 = 17;
  *(_OWORD *)v14 = 0i64;
  LODWORD(v14[1]) = v1;
  if( (v1 & 1) != 0 && (v1 & 0x404) != 0 )
    return -1073741811;
  if( (v1 & 8) != 0 )
  {
    v1 &= 0xFFFFFBFA;
    LODWORD(v14[1]) = v1;
  }
  if( (v1 & 0x400) != 0 && (v1 & 4) != 0
    || (v1 & 0xC0) != 0 && ((v1 & 0xFFFFFC2E) != 0 || (v1 & 0x11) != 17 || (v1 & 0x40) != 0 && (v1 & 0x80u) != 0) )
  {
    return -1073741811;
  }
  if( (v1 & 0xA) == 0 )
    CcNotifyWriteBehind((UINT64)MirrorDispatch);
  v14[0] = (INT64)MirrorDispatch;
  v6 = 0;
  HIDWORD(v14[1]) = 8;
  BYTE4(v15) = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  result = KeWaitForSingleObject(
             (UINT64)&stru_140C4DB30 + 2272,
             18,
             0,
             0,
             (unsigned __int64)&v16 & -(__int64)((v14[1] & 0x200) != 0));
  if( result >= 0 )
  {
    if( result == 258 )
      return 258;
    if( (MiFlags & 4) == 0 )
      MmLockPagableSectionByHandle(ExPageLockHandle);
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&stru_140C4DB30 + 259, 0i64);
    MiLockDynamicMemoryExclusive(&Irp, CurrentThread);
    _InterlockedIncrement((_DWORD *)&stru_140C4DB30 + 1082);
    if( !MiUpdateMirrorBitmaps() )
    {
      v10 = -1073741670;
LABEL_49:
      *(&stru_140C4DB30 + 567) = 0;
      if( BYTE4(v15) == 1 )
        _InterlockedAdd((_DWORD *)&stru_140C4DB30 + 983, 0xFFFFFFFF);
      if( *(&stru_140C4DB30 + 291) )
        *(&stru_140C4DB30 + 291) = 0i64;
      if( CurrentIrql != 17 )
      {
        if( v4 != 17 )
          MiUnlockAllMemoryLists(v9, v8);
        __writecr8(CurrentIrql);
      }
      if( v6 == 1 )
      {
        *(&stru_140C4DB30 + 290) = HIDWORD(v14[1]);
        ExQueueWorkItem((PWORK_QUEUE_ITEM)((char *)&stru_140C4DB30 + 2296), HyperCriticalWorkQueue);
      }
      else
      {
        _InterlockedAdd((_DWORD *)&stru_140C4DB30 + 1082, 0xFFFFFFFF);
        KeSetEvent((PRKEVENT)((char *)&stru_140C4DB30 + 2272), 0, 0);
      }
      MiUnlockDynamicMemoryExclusive(&Irp, CurrentThread);
      if( (_InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 259, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((_EX_PUSH_LOCK *)&stru_140C4DB30 + 259);
      KeAbPostRelease((char *)&stru_140C4DB30 + 2072);
      KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
      if( (MiFlags & 4) == 0 )
        MmUnlockPagableImageSection(ExPageLockHandle);
      return v10;
    }
    MiActOnMirrorBitmap((_RTL_BITMAP_EX *)&stru_140C4DB30 + 147, MiMirrorBitmapSetAllBits);
    v11 = 1;
    LODWORD(v15) = 0;
    if( (v14[1] & 1) != 0 )
    {
      LODWORD(v15) = 3;
LABEL_30:
      v11 = 0;
LABEL_31:
      v10 = (*(__int64(**)(void))MirrorDispatch)();
      if( v10 < 0 )
        goto LABEL_48;
      *(&stru_140C4DB30 + 567) = 1;
      v10 = MiMirrorBrownPhase((INT64)v14);
      if( v10 < 0 )
        goto LABEL_48;
      if( (v14[1] & 2) == 0 && BYTE4(v15) == 1 )
      {
        _InterlockedAdd((_DWORD *)&stru_140C4DB30 + 983, 0xFFFFFFFF);
        BYTE4(v15) = 0;
      }
      CurrentIrql = KeGetCurrentIrql();
      v10 = (*((__int64(__fastcall **)(_QWORD))MirrorDispatch + 1))(0i64);
      if( v10 < 0 )
        goto LABEL_48;
      v4 = KeGetCurrentIrql();
      if( *((_QWORD *)MirrorDispatch + 3) )
        MiActOnMirrorBitmap((_RTL_BITMAP_EX *)&stru_140C4DB30 + 146, MiMirrorBitmapSetAllBits);
      if( v4 < 2u )
      {
        v12 = KeGetCurrentIrql();
        __writecr8(2ui64);
        v4 = v12;
      }
      MiLockAllMemoryLists();
      *(&stru_140C4DB30 + 291) = CurrentThread;
      if( BYTE4(v15) == 1 )
      {
        _InterlockedAdd((_DWORD *)&stru_140C4DB30 + 983, 0xFFFFFFFF);
        BYTE4(v15) = 0;
      }
      *(&stru_140C4DB30 + 567) = 2;
      v10 = MiMirrorBlackPhase((INT64)v14);
      if( v10 < 0
        || (v10 = MiMirrorVerify((INT64)MirrorDispatch), v10 < 0)
        || (v13 = (*((__int64(__fastcall **)(__int64))MirrorDispatch + 1))(1i64),
            *(&stru_140C4DB30 + 291) = 0i64,
            v10 = v13,
            v13 != 1073742484)
        || v11 )
      {
LABEL_48:
        v6 = 0;
      }
      else
      {
        v10 = 0;
        MiResumeFromHibernate(HIDWORD(v14[1]));
        v6 = 1;
      }
      goto LABEL_49;
    }
    if( (v14[1] & 0x400) == 0 )
    {
      if( (v14[1] & 4) != 0 )
      {
        HIDWORD(v14[1]) = 7;
LABEL_29:
        LODWORD(v15) = 2;
        goto LABEL_30;
      }
      if( (v14[1] & 8) == 0 )
        goto LABEL_31;
    }
    HIDWORD(v14[1]) = 0;
    goto LABEL_29;
  }
  return result;
}

Referenced by: