MiDeletePartialCloneVads

INT64 __stdcall MiDeletePartialCloneVads(PVOID P){
  int v1; 
  INT64 result; 
  int v3; 
  _MMVAD_SHORT *v4; 
  _MMVAD_SHORT *v5; 
  INT64 v6; 
  __int64 v7; 
  __int64 *VadWakeList; 
  int v9; 
  __int64 v10; 
  __int64 v11; 
  _SUBSECTION *i; 
  __int64 **v13; 
  __int64 *v14; 
  unsigned int SessionId; 
  int v16; 
  _SUBSECTION *v17; 
  _SUBSECTION *ContainingSubsection; 
  result = (INT64)KeGetCurrentThread();
  v3 = v1;
  v4 = (_MMVAD_SHORT *)P;
  v5 = (_MMVAD_SHORT *)P;
  v6 = *(_QWORD *)(result + 184);
  if( P )
  {
    do
    {
      v4 = *(_MMVAD_SHORT **)v4;
      MiFreeVadEventBitmap((_EPROCESS *)v6, v5, 4ui64);
      if( MiIsVadLargePrivate((INT64)v5) )
      {
        if( v3 == 1 )
        {
          VadWakeList = MiGetVadWakeList(v7, 16);
          MiFreeLargePageView((_EPROCESS *)v6, v5, (UINT64)VadWakeList);
          if( VadWakeList )
            ExFreePoolWithTag(VadWakeList, 0);
        }
      }
      else
      {
        v9 = *((_DWORD *)v5 + 12) & 0x70;
        if( v9 == 80 && *(_QWORD *)(**((_QWORD **)v5 + 9) + 64i64) )
        {
          v10 = *((unsigned __int8 *)v5 + 32);
          v11 = *((unsigned int *)v5 + 6);
          ContainingSubsection = 0i64;
          v17 = 0i64;
          MiGetProtoPteAddress((_MMVAD *)v5, v11 | (v10 << 32), 0i64, &ContainingSubsection);
          MiGetProtoPteAddress(
            (_MMVAD *)v5,
            *((unsigned int *)v5 + 7) | ((unsigned __int64)*((unsigned __int8 *)v5 + 33) << 32),
            0i64,
            &v17);
          for( i = ContainingSubsection; ; i = (_SUBSECTION *)*((_QWORD *)i + 2) )
          {
            MiDecrementLargeSubsections((__int64 *)i, (__int64)i);
            if( i == v17 )
              break;
          }
        }
        else if( v9 == 32 )
        {
          v13 = (__int64 **)*((_QWORD *)v5 + 9);
          v14 = *v13;
          if( ((*v13)[7] & 0x4000000) != 0 )
          {
            SessionId = MmGetSessionIdEx(v6);
            MiDereferencePerSessionProtos(v14, SessionId);
          }
        }
      }
      if( MiVadHasSharedCommit((INT64)v5) )
        MiRemoveSharedCommitNode(**((_QWORD **)v5 + 9), v6, 0i64);
      v16 = *((_DWORD *)v5 + 12);
      if( (v16 & 0x100000) == 0 && (v16 & 0x70) == 32 && (v16 & 0x200000) != 0 )
        --*(_QWORD *)(*(_QWORD *)(v6 + 1680) + 384i64);
      MiFreePlaceholderStorage((INT64)v5);
      MiFreeVadEvents((__int64)v5);
      ExFreePoolWithTag(v5, 0);
      v5 = v4;
    }
    while( v4 );
  }
  return result;
}

Referenced by: