MiReferenceCfgVad

VOID __stdcall MiReferenceCfgVad(_ETHREAD *CurrentThread, VOID *VadBaseAddress, _MI_CFG_BITMAP_TYPE Type){
  __int64 v6; 
  _EPROCESS *Process; 
  _MMWSL_INSTANCE *VmWorkingSetList; 
  __int64 v9; 
  _EX_PUSH_LOCK *v10; 
  unsigned __int64 v11; 
  unsigned int v12; 
  _EWOW64PROCESS *WoW64Process; 
  __int16 Machine; 
  INT64 v15; 

  v6 = 4i64 * (int)Type;
  Process = KeGetCurrentThread()->ApcState.Process;
  VmWorkingSetList = Process->Vm.Instance.VmWorkingSetList;
  LODWORD(v9) = MiObtainReferencedVadEx((UINT64)VadBaseAddress, 2, &v15);
  v10 = (_EX_PUSH_LOCK *)v9;
  v11 = *(unsigned int *)(v9 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v9 + 33) << 32);
  (&VmWorkingSetList[11].NextPteToAccessClear)[v6] = (_MMPTE *)v9;
  (&VmWorkingSetList[11].NextPteToTrim)[v6] = (_MMPTE *)VadBaseAddress;
  v12 = 0;
  *(unsigned int *)((char *)&VmWorkingSetList[11].LastAccessClearingRemainder + v6 * 8) = 0;
  (&VmWorkingSetList[11].NextPteToAge)[v6] = (_MMPTE *)(((v11 + 1) << 12) - (_QWORD)VadBaseAddress);
  if( Type == CfgBitMapWow64 )
  {
    WoW64Process = Process->WoW64Process;
    if( !WoW64Process || (Machine = WoW64Process->Machine) == 0 )
      Machine = -31132;
    LOBYTE(v12) = Machine == 452;
    *(unsigned int *)((char *)&VmWorkingSetList[11].LastAccessClearingRemainder + v6 * 8) = v12;
  }
  MiUnlockVadShared(&CurrentThread->Tcb, v10);
}

Referenced by: