MiInsertVad

VOID __stdcall MiInsertVad(_MMVAD *Vad, _EPROCESS *CurrentProcess){
  char v2; 
  _MI_PHYSICAL_VIEW *v3; 
  char v4; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  _MMSUPPORT_SHARED *p_Shared; 
  UINT8 CurrentIrql; 
  unsigned __int64 HighestUserAddress; 
  unsigned __int64 VirtualSize; 
  _RTL_BALANCED_NODE *Root; 
  unsigned __int64 v14; 
  _RTL_BALANCED_NODE *v15; 
  union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v16; 
  union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v17; 

  v3 = 0i64;
  v4 = v2;
  v7 = Vad->Core.EndingVpn | ((unsigned __int64)Vad->Core.EndingVpnHigh << 32);
  v8 = Vad->Core.StartingVpn | ((unsigned __int64)Vad->Core.StartingVpnHigh << 32);
  if( (v2 & 1) != 0 )
  {
    if( (CurrentProcess->Vm.Instance.Flags._bf_0 & 7) == 2 )
      p_Shared = (_MMSUPPORT_SHARED *)((char *)&stru_140C4DB30 + 6544);
    else
      p_Shared = &CurrentProcess->Vm.Shared;
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    ExpAcquireSpinLockExclusive((INT64 *)&p_Shared->WorkingSetLock, CurrentIrql);
    p_Shared->GoodCitizenWaiting = 0;
    v3 = 0i64;
  }
  else
  {
    CurrentIrql = 17;
  }
  HighestUserAddress = (unsigned __int64)CurrentProcess->HighestUserAddress;
  ++CurrentProcess->VadCount;
  CurrentProcess->VadHint = Vad;
  if( v7 <= HighestUserAddress >> 12 && (v4 & 2) == 0 )
  {
    CurrentProcess->VirtualSize += ((v7 - v8) << 12) + 4096;
    VirtualSize = CurrentProcess->VirtualSize;
    if( CurrentProcess->PeakVirtualSize < VirtualSize )
      CurrentProcess->PeakVirtualSize = VirtualSize;
  }
  Root = CurrentProcess->VadRoot.Root;
  v14 = Vad->Core.StartingVpn | ((unsigned __int64)Vad->Core.StartingVpnHigh << 32);
  LOBYTE(v15) = 0;
  if( Root )
  {
    while( 1 )
    {
      if( v14 <= (HIDWORD(Root[1].Left) | ((unsigned __int64)BYTE1(Root[1].Right) << 32))
        && v14 < (LODWORD(Root[1].Children[0]) | ((unsigned __int64)LOBYTE(Root[1].Right) << 32)) )
      {
        v15 = Root->Children[0];
        if( !Root->Children[0] )
          break;
      }
      else
      {
        v15 = Root->Children[1];
        if( !v15 )
        {
          LOBYTE(v15) = 1;
          break;
        }
      }
      Root = v15;
    }
  }
  RtlAvlInsertNodeEx(&CurrentProcess->VadRoot.Root, (UINT64)Root, (BOOL)v15, (_RTL_BALANCED_NODE *)Vad);
  v16.LongFlags = (unsigned int)Vad->Core.u;
  if( (v16.LongFlags & 0x100000) == 0 || (v16.LongFlags & 0x400000) == 0 && (v16.LongFlags & 0xC0000) < 0x80000 )
  {
    if( !MiVadMapsLargeImage(Vad) )
      goto LABEL_18;
    v16.LongFlags = (unsigned int)Vad->Core.u;
  }
  if( (unsigned __int64)MiVadPageSizes[((unsigned __int64)v16.LongFlags >> 18) & 3] >= 0x200 )
    ++CurrentProcess->LargePrivateVadCount;
LABEL_18:
  v17.LongFlags = (unsigned int)Vad->Core.u;
  if( (v17.LongFlags & 0x70) == 16 )
  {
    ++*(_QWORD *)&CurrentProcess->Vm.Instance.VmWorkingSetList[7].LastAccessClearingRemainder;
    v17.LongFlags = (unsigned int)Vad->Core.u;
  }
  if( (v17.LongFlags & 0x70) == 48 && (v17.LongFlags & 0x3100000) != 34603008 )
    v3 = (_MI_PHYSICAL_VIEW *)(MiLocateLockedVadEvent((__int64)Vad, 256) + 1);
  if( CurrentIrql != 17 )
    MiUnlockWorkingSetExclusive(&CurrentProcess->Vm.Instance, CurrentIrql);
  if( v3 )
    MiAweViewInserter(CurrentProcess, v3);
}

Referenced by: