MiDeprioritizeVad

VOID __stdcall MiDeprioritizeVad(_MMVAD *Vad, VOID *VirtualAddress, _ETHREAD *Thread){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  _CONTROL_AREA *ControlArea; 
  _FILE_OBJECT *v10; 
  UINT64 FsContext; 
  INT64 v12; 
  signed __int32 v13; 
  unsigned __int64 v14; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = CurrentThread->Tcb.ApcState.Process;
  --CurrentThread->Tcb.SpecialApcDisable;
  if( MiTryLockVad(CurrentThread, &Vad->Core) )
  {
    if( (Vad->Core.u.LongFlags & 4) == 0 )
    {
      v7 = Vad->Core.StartingVpn | ((unsigned __int64)Vad->Core.StartingVpnHigh << 32);
      v8 = ((unsigned __int64)VirtualAddress >> 12) - v7;
      if( (Vad->u2.LongFlags2 & 0x2000000) != 0 )
      {
        ControlArea = Vad->Subsection->ControlArea;
        v10 = MiReferenceControlAreaFile(ControlArea);
        FsContext = (UINT64)v10->FsContext;
        MiDereferenceControlAreaFile(ControlArea, v10);
        if( (Process->Flags & 0x4000) != 0
          && (v14 = v8 & 0xFFFFFFFFFFFFFF00ui64,
              (unsigned int)PfCheckDeprioritizeFile(Process->ImagePathHash, FsContext, v14, v12) == 1) )
        {
          if( (Vad->u2.LongFlags2 & 0x2000000) != 0 )
            MiDeprioritizeVirtualAddresses((v7 << 12) + ((v14 - 256) << 12), 256i64, &Process->Vm.Instance, 18);
        }
        else
        {
          Vad->u2.LongFlags2 &= ~0x2000000u;
        }
      }
    }
    MiUnlockAndDereferenceVad(&Vad->Core);
  }
  else
  {
    v13 = _InterlockedDecrement(&Vad->Core.ReferenceCount);
    if( v13 == -1 )
      __fastfail(0xEu);
    if( !v13 && (Vad->Core.u.LongFlags & 4) != 0 )
      ExFreePoolWithTag(Vad, 0);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
}

Referenced by: