MiDeletePartialCloneVads
NTSTATUS __stdcall MiDeletePartialCloneVads(PVOID P){
int v1;
_ETHREAD *CurrentThread;
int v3;
_QWORD *v4;
PVOID v5;
_EPROCESS *Process;
int v7;
__int64 v8;
__int64 *VadWakeList;
int v10;
_CONTROL_AREA **v11;
_CONTROL_AREA *v12;
unsigned int SessionId;
int v14;
int v15;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = v1;
v4 = P;
v5 = P;
Process = CurrentThread->Tcb.ApcState.Process;
if( P )
{
do
{
v4 = (_QWORD *)*v4;
MiFreeVadEventBitmap((ULONG_PTR)Process, (_MMVAD_SHORT *)v5, 4ui64);
LOBYTE(v7) = MiIsVadLargePrivate((INT64)v5);
if( v7 )
{
if( v3 == 1 )
{
VadWakeList = MiGetVadWakeList(v8, 16);
MiFreeLargePageView(Process, (_MMVAD_SHORT *)v5, (UINT64)VadWakeList);
if( VadWakeList )
ExFreePoolWithTag(VadWakeList, 0);
}
}
else
{
v10 = *((_DWORD *)v5 + 12) & 0x70;
if( v10 == 80 && *(_QWORD *)(**((_QWORD **)v5 + 9) + 64i64) )
{
MiGetProtoPteAddress();
MiGetProtoPteAddress();
MiDecrementLargeSubsections(0i64, 0i64);
}
else if( v10 == 32 )
{
v11 = (_CONTROL_AREA **)*((_QWORD *)v5 + 9);
v12 = *v11;
if( ((*v11)->u.LongFlags & 0x4000000) != 0 )
{
SessionId = MmGetSessionIdEx(Process);
MiDereferencePerSessionProtos(v12, SessionId);
}
}
}
LOBYTE(v14) = MiVadHasSharedCommit((INT64)v5);
if( v14 )
MiRemoveSharedCommitNode(**((_CONTROL_AREA ***)v5 + 9), Process, 0i64);
v15 = *((_DWORD *)v5 + 12);
if( (v15 & 0x100000) == 0 && (v15 & 0x70) == 32 && (v15 & 0x200000) != 0 )
--*(_QWORD *)&Process->Vm.Instance.VmWorkingSetList[9].LastAccessClearingRemainder;
MiFreePlaceholderStorage((INT64)v5);
MiFreeVadEvents((_MMVAD_SHORT *)v5);
LODWORD(CurrentThread) = (unsigned int)ExFreePoolWithTag(v5, 0);
v5 = v4;
}
while( v4 );
}
return(int)CurrentThread;
}Referenced by:
MiAllocateChildVads
MiInsertChildVads