MiUnlockVadRange

VOID __stdcall MiUnlockVadRange(_EPROCESS *Process, PVOID StartingVa, UINT64 NumberOfVads){
  int v3; 
  _ETHREAD *CurrentThread; 
  int v5; 
  RTL_BALANCED_NODE *Address; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  unsigned __int64 i; 
  _QWORD *v12; 
  $2AC33BEB5BE0E2B4BDE1FE63E3EEE4EC *v13; 
  RTL_BALANCED_NODE *v14; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = v3;
  if( StartingVa == (PVOID)-1i64 )
  {
    v14 = (RTL_BALANCED_NODE *)*((_QWORD *)Process + 251);
    Address = 0i64;
    while( v14 )
    {
      Address = v14;
      v14 = v14->Children[0];
    }
  }
  else
  {
    Address = MiLocateAddress((UINT64)StartingVa);
  }
  if( NumberOfVads )
  {
    while( 1 )
    {
      v9 = (unsigned __int64)Address->Children[1];
      v10 = (unsigned __int64)Address;
      if( v9 )
      {
        v12 = *(_QWORD **)v9;
        if( *(_QWORD *)v9 )
        {
          do
          {
            v9 = (unsigned __int64)v12;
            v12 = (_QWORD *)*v12;
          }
          while( v12 );
        }
      }
      else
      {
        for( i = Address->ParentValue; ; i = *(_QWORD *)(v9 + 16) )
        {
          v9 = i & 0xFFFFFFFFFFFFFFFCui64;
          if( !v9 || *(_QWORD *)v9 == v10 )
            break;
          v10 = v9;
        }
      }
      if( NumberOfVads == 1 )
        break;
      v13 = &Address[1].16;
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&Address[1].16, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)&Address[1].16);
      KeAbPostRelease(v13);
      Address = (RTL_BALANCED_NODE *)v9;
      if( !--NumberOfVads )
        goto LABEL_13;
    }
    MiUnlockVad((__int64)CurrentThread, (__int64)Address);
  }
LABEL_13:
  if( v5 )
    UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, (__int64)Process);
  else
    UNLOCK_ADDRESS_SPACE_SHARED((__int64)CurrentThread, (__int64)Process);
}

Referenced by: