MiDeleteVadBitmap

VOID __stdcall MiDeleteVadBitmap(_EPROCESS *Process){
  ULONG_PTR v1; 
  _QWORD *v3; 
  __int64 v4; 
  UINT64 v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  _QWORD *v9; 
  __int64 v10; 
  _MI_PARTITION *v11; 
  _MI_PARTITION *v12; 
  __int64 v13; 
  ULONG_PTR v14; 
  UINT64 v15; 
  unsigned __int64 v16; 
  __int64 v17[6]; 
  v1 = *((_QWORD *)Process + 158);
  memset(v17, 0, sizeof(v17));
  if( v1 )
    KeBugCheckEx(0x1Au, 0x3455ui64, (ULONG_PTR)Process, v1, 0i64);
  v3 = (_QWORD *)*((_QWORD *)Process + 210);
  if( v3 )
  {
    v4 = v3[34];
    v5 = MiHyperSpaceSize();
    MiDeletePagablePteRange((__int64)Process + 1664, 0x11u, v6, v5 + v6 - 1, 0, 0, v17);
    v7 = v17[1];
    MiGetProcessPartition(Process);
    v8 = v3[36] + v4;
    v9 = v3 + 74;
    v10 = 0i64;
    v12 = v11;
    v13 = 2i64;
    do
    {
      v10 += *v9++;
      --v13;
    }
    while( v13 );
    v14 = v10 + v8;
    if( v14 )
      MiReturnFullProcessCharges((ULONG_PTR)Process, v14);
    v15 = v14 - v7;
    if( v15 )
      MiReturnCommit(v12, v15);
    HalSystemVectorDispatchEntry();
    if( *((_QWORD *)Process + 238) )
    {
      MiUpdateChargedWsles((INT64)Process + 1664);
      MiReturnFullProcessCommitment((ULONG_PTR)Process, v16);
    }
  }
}

Referenced by:

MiDeleteFinalPageTables