MiUnmapVad
void __fastcall MiUnmapVad(
_MMVAD *Vad,
__int64 Flags,
__int64 a3,
__int64 a4,
__int64 a5,
__int64 a6,
__int64 a7,
int a8){
_CONTROL_AREA *v10;
_FILE_OBJECT *v11;
UINT64 FsContext;
__int64 v13;
if( (*((_DWORD *)Vad + 16) & 0x2000000) != 0 )
{
v10 = (_CONTROL_AREA *)**((_QWORD **)Vad + 9);
v11 = MiReferenceControlAreaFile(v10);
FsContext = (UINT64)v11->FsContext;
MiDereferenceControlAreaFile((__int64)v10, (unsigned __int64)v11);
v13 = *((_QWORD *)KeGetCurrentThread() + 23);
if( (*(_DWORD *)(v13 + 1124) & 0x4000) != 0 )
PfCheckDeprioritizeFile(
*(unsigned int *)(v13 + 1524),
FsContext,
(*((unsigned int *)Vad + 7) | ((unsigned __int64)*((unsigned __int8 *)Vad + 33) << 32))
- (*((unsigned int *)Vad + 6) | ((unsigned __int64)*((unsigned __int8 *)Vad + 32) << 32))
+ 1);
}
MiDeleteVad(Vad, Flags);
}Referenced by:
MiMapViewOfDataSection
MiMapViewOfImageSection
MiUnmapViewOfSection