MiObtainReferencedVadEx

NTSTATUS __stdcall MiObtainReferencedVadEx(UINT64 a1, CHAR a2, INT64 *a3){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  _EPROCESS *v8; 
  _MMVAD_SHORT *VadHint; 
  unsigned __int64 v10; 
  _EX_PUSH_LOCK *p_PushLock; 
  int v12; 
  bool v13; 
  int v15; 
  int v16; 

  *(_DWORD *)a3 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = CurrentThread->Tcb.ApcState.Process;
  --CurrentThread->Tcb.SpecialApcDisable;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockSharedEx(&Process->AddressCreationLock, 0i64);
  CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 2u;
  v8 = KeGetCurrentThread()->ApcState.Process;
  VadHint = (_MMVAD_SHORT *)v8->VadHint;
  if( !VadHint )
  {
LABEL_15:
    v15 = -1073741664;
    if( (Process->Flags & 0x20) != 0 )
      v15 = -1073741558;
    goto LABEL_17;
  }
  v10 = a1 >> 12;
  if( v10 < (VadHint->StartingVpn | ((unsigned __int64)VadHint->StartingVpnHigh << 32))
    || v10 > (VadHint->EndingVpn | ((unsigned __int64)VadHint->EndingVpnHigh << 32)) )
  {
    VadHint = (_MMVAD_SHORT *)v8->VadRoot.Root;
    if( VadHint )
    {
      while( 1 )
      {
        if( v10 > (VadHint->EndingVpn | ((unsigned __int64)VadHint->EndingVpnHigh << 32)) )
        {
          VadHint = (_MMVAD_SHORT *)VadHint->ExtraCreateInfo;
        }
        else
        {
          if( v10 >= (VadHint->StartingVpn | ((unsigned __int64)VadHint->StartingVpnHigh << 32)) )
          {
            v8->VadHint = VadHint;
            goto LABEL_4;
          }
          VadHint = VadHint->NextVad;
        }
        if( !VadHint )
          goto LABEL_15;
      }
    }
    goto LABEL_15;
  }
LABEL_4:
  if( (a2 & 1) == 0 && (Process->Flags & 0x20) != 0 )
  {
    v15 = -1073741558;
LABEL_17:
    *(_DWORD *)a3 = v15;
    UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    return 0;
  }
  if( !_InterlockedIncrement(&VadHint->ReferenceCount) )
    __fastfail(0xEu);
  UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
  --CurrentThread->Tcb.SpecialApcDisable;
  p_PushLock = &VadHint->PushLock;
  v12 = a2 & 2;
  if( v12 )
  {
    ExAcquirePushLockSharedEx(p_PushLock, 0i64);
    CurrentThread->_bf_1 |= 0x40u;
  }
  else
  {
    ExAcquirePushLockExclusiveEx(p_PushLock, 0i64);
    CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 0x80u;
  }
  v13 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
  if( v13
    && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
  {
    KiCheckForKernelApcDelivery();
  }
  if( (VadHint->u.LongFlags & 4) != 0 )
  {
    if( v12 )
    {
      MiUnlockVadShared(&CurrentThread->Tcb, (_EX_PUSH_LOCK *)VadHint);
      --CurrentThread->Tcb.SpecialApcDisable;
      ExAcquirePushLockExclusiveEx(&VadHint->PushLock, 0i64);
      CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 0x80u;
    }
    MiWaitForVadDeletion(VadHint);
    MiUnlockAndDereferenceVad(VadHint);
    v16 = -1073741558;
    if( (Process->Flags & 0x20) == 0 )
      v16 = -1073741664;
    *(_DWORD *)a3 = v16;
  }
  else
  {
    if( v10 >= (VadHint->StartingVpn | ((unsigned __int64)VadHint->StartingVpnHigh << 32))
      && v10 <= (VadHint->EndingVpn | ((unsigned __int64)VadHint->EndingVpnHigh << 32)) )
    {
      return(int)VadHint;
    }
    if( v12 )
      MiUnlockAndDereferenceVadShared(VadHint);
    else
      MiUnlockAndDereferenceVad(VadHint);
    *(_DWORD *)a3 = -1073741664;
  }
  return 0;
}

Referenced by: