MiCreateWriteWatchView

NTSTATUS __stdcall MiCreateWriteWatchView(_EPROCESS *Process, _MMVAD_SHORT *Vad, UINT64 NumberOfPages){
  unsigned __int64 v4; 
  __int64 v5; 
  _MMVAD_SHORT *v6; 
  NTSTATUS result; 

  LODWORD(v4) = MiGetVadMandatoryPageSize((INT64)Vad);
  result = MiCreateVadEventBitmap(Process, v6, (~(v4 - 1) & (v4 + v5 - 1)) / v4, 4ui64);
  if( result >= 0 )
  {
    _InterlockedOr((volatile signed __int32 *)&Process->1124, 0x8000u);
    return 0;
  }
  return result;
}

Referenced by: