MiRemoveSecureEntry

VOID __stdcall MiRemoveSecureEntry(_MMVAD *Vad, _MI_VAD_EVENT_BLOCK *SecureToRemove){
  _MI_VAD_EVENT_BLOCK **v2; 
  unsigned int v5; 
  int v6; 
  __int64 v7; 
  INT64 *SharedVm; 
  KIRQL v9; 
  _MI_VAD_EVENT_BLOCK *i; 
  v2 = (_MI_VAD_EVENT_BLOCK **)((char *)Vad + 56);
  v5 = 0;
  v6 = 0;
  v7 = *((_QWORD *)KeGetCurrentThread() + 23);
  SharedVm = MiGetSharedVm(v7 + 1664);
  v9 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
  *((_DWORD *)SharedVm + 1) = 0;
  for( i = *v2; i; i = *(_MI_VAD_EVENT_BLOCK **)i )
  {
    if( *((_DWORD *)i + 16) == 2 && v5 <= 1 )
      ++v5;
    if( i == SecureToRemove )
    {
      v6 = 1;
      *v2 = *(_MI_VAD_EVENT_BLOCK **)i;
    }
    if( v5 > 1 && v6 == 1 )
      break;
    v2 = (_MI_VAD_EVENT_BLOCK **)i;
  }
  MiUnlockWorkingSetExclusive(v7 + 1664, v9);
  if( !v6 )
    KeBugCheckEx(0x1Au, 0x15001ui64, (ULONG_PTR)Vad, (ULONG_PTR)SecureToRemove, 0i64);
  if( (*((_DWORD *)SecureToRemove + 2) & 0x10) != 0 )
    MiUnsecureVirtualMemoryAgainstWrites(Vad, *((VOID **)SecureToRemove + 1), *((VOID **)SecureToRemove + 2));
  if( v5 == 1 )
    MiSetVadFlags((INT64)Vad, 1, 0);
  ExFreePoolWithTag(SecureToRemove, 0);
}

Referenced by: