MiCaptureWriteWatchDirtyBit

VOID __stdcall MiCaptureWriteWatchDirtyBit(_EPROCESS *Process, VOID *VirtualAddress, _MMVAD_SHORT *Vad){
  _MMVAD *Address; 
  union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v4; 
  __int64 ********LockedVadEvent; 
  INT64 v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 

  Address = (_MMVAD *)Vad;
  if( (Process->Flags & 0x20) == 0 && (Vad || (Address = MiLocateAddress(VirtualAddress)) != 0i64) )
  {
    v4.LongFlags = (unsigned int)Address->Core.u;
    if( (v4.LongFlags & 4) == 0 && (v4.LongFlags & 0x300000) == 3145728 )
    {
      LockedVadEvent = MiLocateLockedVadEvent((__int64)Address, 4);
      LODWORD(v7) = MiGetVadMandatoryPageSize(v6);
      v9 = ((v8 >> 12) - (Address->Core.StartingVpn | ((unsigned __int64)Address->Core.StartingVpnHigh << 32))) / v7;
      MiLockVadCore((INT64)Address);
      _bittestandset64((signed __int64 *)LockedVadEvent[2], v9);
      MiUnlockVadCore((INT64)Address, 2u);
    }
  }
}

Referenced by: