MiWriteUselessChildPte
CHAR __stdcall MiWriteUselessChildPte(UINT64 *a1){
__int64 v2;
int v3;
_ETHREAD *CurrentThread;
bool v5;
v2 = MiSwizzleInvalidPte(128i64);
v3 = 0;
LOBYTE(CurrentThread) = MiPteInShadowRange((UINT64)a1);
if( (_DWORD)CurrentThread )
{
LODWORD(CurrentThread) = MiPteHasShadow();
if( (_DWORD)CurrentThread )
{
v3 = 1;
if( *(&stru_140C4DB30 + 537) )
goto LABEL_9;
v5 = (v2 & 1) == 0;
}
else
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (CurrentThread->Tcb.ApcState.Process->Flags3 & 0x1000) == 0 )
goto LABEL_9;
v5 = (v2 & 1) == 0;
}
if( !v5 )
{
LOBYTE(CurrentThread) = 0;
v2 |= 0x8000000000000000ui64;
}
}
LABEL_9:
*a1 = v2;
if( v3 )
LOBYTE(CurrentThread) = MiWritePteShadow();
return(char)CurrentThread;
}Referenced by:
MiBuildForkPte
MiHandleForkTransitionPte