MiInsertVadEvent

void __fastcall MiInsertVadEvent(__int64 a1, _QWORD *a2, int a3){
  INT64 *v5; 
  _EPROCESS *Process; 
  __int8 bf_0; 
  _MMSUPPORT_INSTANCE *p_Instance; 
  UINT8 v9; 
  UINT8 v10; 

  if( a3 == 1 )
  {
    v5 = (INT64 *)((char *)&stru_140C4DB30 + 6544);
    Process = KeGetCurrentThread()->ApcState.Process;
    bf_0 = Process->Vm.Instance.Flags._bf_0;
    p_Instance = &Process->Vm.Instance;
    if( (bf_0 & 7) != 2 )
      v5 = (INT64 *)&p_Instance[1];
    v9 = ExAcquireSpinLockExclusive(v5);
    *((_DWORD *)v5 + 1) = 0;
    v10 = v9;
  }
  else
  {
    v10 = 17;
    p_Instance = 0i64;
  }
  *a2 = *(_QWORD *)(a1 + 56);
  *(_QWORD *)(a1 + 56) = a2;
  if( v10 != 17 )
    MiUnlockWorkingSetExclusive(p_Instance, v10);
}

Referenced by: