MiDecommitRegion

VOID __stdcall MiDecommitRegion(_MMVAD_SHORT *Vad, PVOID StartingAddress, PVOID EndingAddress){
  ULONG_PTR v4; 
  PVOID v5; 
  MMPTE *PteAddress; 
  unsigned __int64 v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  __int64 v10; 
  unsigned int v11; 
  __int64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  _MI_PARTITION *v15; 
  UINT64 v16; 
  __int128 v17; 
  __int128 v18; 
  __int128 v19; 
  __int128 v20; 
  v18 = 0i64;
  v19 = 0i64;
  v20 = 0i64;
  v17 = 0i64;
  v4 = *((_QWORD *)KeGetCurrentThread() + 23);
  MiGetPteAddress(EndingAddress);
  PteAddress = MiGetPteAddress(v5);
  v8 = ((__int64)(v7 - (_QWORD)PteAddress) >> 3) + 1;
  MiDecommitPages(v9, v7, v4, (__int64)Vad, 1, &v18);
  if( *((_QWORD *)&v20 + 1) )
  {
    MiFreeLargePages(*((_MMPFN **)&v20 + 1));
    *((_QWORD *)&v18 + 1) = v10;
  }
  v11 = *((_DWORD *)Vad + 13);
  v12 = v11;
  LODWORD(v12) = v11 & 0x7FFFFFFF;
  v13 = v8 - *((_QWORD *)&v19 + 1);
  v14 = (v12 | ((unsigned __int64)*((unsigned __int8 *)Vad + 34) << 31)) - v13;
  *((_BYTE *)Vad + 34) = v14 >> 31;
  *((_DWORD *)Vad + 13) = v11 ^ (v14 ^ v11) & 0x7FFFFFFF;
  if( (*((_DWORD *)Vad + 12) & 0x500000) == 5242880 )
    _InterlockedExchangeAdd64((volatile signed __int64 *)(v4 + 2032), -v13);
  if( !(unsigned int)MiVadCommitCrossPartition((INT64)Vad) )
  {
    MiFillCommitReturnInfo(v13, (__int64)&v18, &v17);
    if( (_QWORD)v17 )
      MiReturnFullProcessCharges(v4, v17);
    if( *((_QWORD *)&v17 + 1) )
    {
      MiGetProcessPartition((_EPROCESS *)v4);
      MiReturnCommit(v15, v16);
    }
  }
}

Referenced by: