MiDeprioritizeVad

VOID __fastcall MiDeprioritizeVad(UINT64 *P, UINT64 a2){
  _ETHREAD *CurrentThread; 
  __int64 v5; 
  unsigned __int64 v6; 
  UINT64 v7; 
  _CONTROL_AREA *v8; 
  _FILE_OBJECT *v9; 
  UINT64 FsContext; 
  signed __int32 v11; 
  unsigned __int64 v12; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = *((_QWORD *)CurrentThread + 23);
  --*((_WORD *)CurrentThread + 243);
  if( (unsigned int)MiTryLockVad((__int64)CurrentThread, (__int64)P) )
  {
    if( (P[6] & 4) == 0 )
    {
      v6 = *((unsigned int *)P + 6) | ((unsigned __int64)*((unsigned __int8 *)P + 32) << 32);
      v7 = (a2 >> 12) - v6;
      if( (P[8] & 0x2000000) != 0 )
      {
        v8 = *(_CONTROL_AREA **)P[9];
        v9 = MiReferenceControlAreaFile(v8);
        FsContext = (UINT64)v9->FsContext;
        MiDereferenceControlAreaFile((__int64)v8, (unsigned __int64)v9);
        if( (*(_DWORD *)(v5 + 1124) & 0x4000) != 0
          && (v12 = v7 & 0xFFFFFFFFFFFFFF00ui64,
              (unsigned int)PfCheckDeprioritizeFile(*(unsigned int *)(v5 + 1524), FsContext, v12) == 1) )
        {
          if( (P[8] & 0x2000000) != 0 )
            MiDeprioritizeVirtualAddresses((v6 << 12) + ((v12 - 256) << 12), 256i64, v5 + 1664, 18);
        }
        else
        {
          *((_DWORD *)P + 16) &= ~0x2000000u;
        }
      }
    }
    MiUnlockAndDereferenceVad(P);
  }
  else
  {
    v11 = _InterlockedDecrement((volatile signed __int32 *)P + 9);
    if( v11 == -1 )
      __fastfail(0xEu);
    if( !v11 && (P[6] & 4) != 0 )
      ExFreePoolWithTag(P, 0);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
}

Referenced by: