MiInitializeVadBitMap

NTSTATUS __stdcall MiInitializeVadBitMap(UINT64 ProcessIsClone){
  _ETHREAD *CurrentThread; 
  NTSTATUS v2; 
  int v3; 
  __int64 v4; 
  _EPROCESS *Process; 
  _MMWSL_INSTANCE *VmWorkingSetList; 
  __int64 *i; 
  unsigned __int64 v8; 
  NTSTATUS v9; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v2 = 0;
  v3 = ProcessIsClone;
  v4 = 0i64;
  Process = CurrentThread->Tcb.ApcState.Process;
  VmWorkingSetList = Process->Vm.Instance.VmWorkingSetList;
  if( *(_QWORD *)&VmWorkingSetList[6].LastAccessClearingRemainder )
  {
    for( i = (__int64 *)&VmWorkingSetList[1].LastAccessClearingRemainder; ; i += 9 )
    {
      v8 = (unsigned __int64)i[6] >> 15 << 12;
      *i = i[6] & 0x7FFF;
      *(i - 1) = *(&stru_140C4DB30 + 174) + 4 * (v8 >> 2);
      if( v3 == 1 )
        *(i - 2) = 0i64;
      LOCK_ADDRESS_SPACE(CurrentThread, Process);
      v9 = MiExpandVadBitMap((_MI_VAD_ALLOCATION_CELL *)i - 4, 1ui64);
      i[2] = *i;
      UNLOCK_ADDRESS_SPACE(CurrentThread, Process);
      if( !v9 )
        break;
      if( (unsigned __int64)++v4 >= *(_QWORD *)&VmWorkingSetList[6].LastAccessClearingRemainder )
        return v2;
    }
    return -1073741801;
  }
  return v2;
}

Referenced by: