MiDeleteVadBitmap
VOID __stdcall MiDeleteVadBitmap(_EPROCESS *Process){
ULONG_PTR v1;
_QWORD *v3;
__int64 v4;
UINT64 v5;
unsigned __int64 v6;
__int64 v7;
__int64 v8;
_QWORD *v9;
__int64 v10;
_MI_PARTITION *v11;
_MI_PARTITION *v12;
__int64 v13;
ULONG_PTR v14;
UINT64 v15;
unsigned __int64 v16;
__int64 v17[6];
v1 = *((_QWORD *)Process + 158);
memset(v17, 0, sizeof(v17));
if( v1 )
KeBugCheckEx(0x1Au, 0x3455ui64, (ULONG_PTR)Process, v1, 0i64);
v3 = (_QWORD *)*((_QWORD *)Process + 210);
if( v3 )
{
v4 = v3[34];
v5 = MiHyperSpaceSize();
MiDeletePagablePteRange((__int64)Process + 1664, 0x11u, v6, v5 + v6 - 1, 0, 0, v17);
v7 = v17[1];
MiGetProcessPartition(Process);
v8 = v3[36] + v4;
v9 = v3 + 74;
v10 = 0i64;
v12 = v11;
v13 = 2i64;
do
{
v10 += *v9++;
--v13;
}
while( v13 );
v14 = v10 + v8;
if( v14 )
MiReturnFullProcessCharges((ULONG_PTR)Process, v14);
v15 = v14 - v7;
if( v15 )
MiReturnCommit(v12, v15);
HalSystemVectorDispatchEntry();
if( *((_QWORD *)Process + 238) )
{
MiUpdateChargedWsles((INT64)Process + 1664);
MiReturnFullProcessCommitment((ULONG_PTR)Process, v16);
}
}
}Referenced by:
MiDeleteFinalPageTables