MiUnmapViewOfSection

__int64 __fastcall MiUnmapViewOfSection(ULONG_PTR BugCheckParameter1, unsigned __int64 a2, unsigned int a3, int a4){
  int v4; 
  __int64 v5; 
  __int64 v8; 
  int v9; 
  ULONG_PTR v10; 
  __int64 v11; 
  unsigned int v12; 
  unsigned int v13; 
  __int64 v14; 
  unsigned __int64 v15; 
  __int64 v16; 
  int v17; 
  INT64 ***VadEvent; 
  __int64 ImageSize; 
  __int64 ImageChecksum; 
  __int64 ImageSignatureLevel; 
  int ImageSignatureType; 
  INT64 a3a; 
  __int64 v25; 
  PVOID v26; 
  _KAPC_STATE ApcState; 
  v26 = (PVOID)BugCheckParameter1;
  LODWORD(a3a) = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  v4 = 0;
  v5 = 0i64;
  v25 = 0i64;
  HIDWORD(a3a) = a3;
  v8 = *((_QWORD *)KeGetCurrentThread() + 23);
  v9 = a4 & 0x4000000;
  if( (a4 & 0x4000000) != 0 && a2 != (a2 & 0xFFFFFFFFFFFFF000ui64) )
    return 3221225712i64;
  if( v8 != BugCheckParameter1 )
  {
    KiStackAttachProcess((_KPROCESS *)BugCheckParameter1, 0i64, &ApcState);
    v4 = 1;
  }
  v10 = MiObtainReferencedVadEx(a2, 1, &a3a);
  v11 = v10;
  if( !v10 )
  {
    v17 = a3a;
    if( (_DWORD)a3a == -1073741664 )
      v17 = -1073741799;
    goto LABEL_13;
  }
  v12 = *(_DWORD *)(v10 + 48);
  v13 = v12 >> 4;
  if( (v12 & 0x100000) == 0 || (v13 & 7) == 1 )
  {
    v14 = *(unsigned int *)(v10 + 24);
    v15 = (v14 | ((unsigned __int64)*(unsigned __int8 *)(v10 + 32) << 32)) << 12;
    if( (v13 & 7) == 2 && (v12 & 0xF80) == 896 )
      v5 = (v14 | ((unsigned __int64)*(unsigned __int8 *)(v10 + 32) << 32)) << 12;
    if( (v12 & 8) != 0 && (*(_DWORD *)(BugCheckParameter1 + 1124) & 0x20) == 0 )
    {
      v17 = MiCheckSecuredVad(
              v10,
              v15,
              ((*(unsigned int *)(v10 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v10 + 33) << 32))
             - (v14 | ((unsigned __int64)*(unsigned __int8 *)(v10 + 32) << 32))
             + 1) << 12,
              0x55u,
              *((_BYTE *)KeGetCurrentThread() + 562));
      if( v17 < 0 )
        goto LABEL_35;
    }
    if( v9 )
    {
      if( v15 != a2 || (VadEvent = MiLocateVadEvent(v11, 128i64)) == 0i64 )
      {
        v17 = -1073741800;
        goto LABEL_35;
      }
      v16 = (__int64)VadEvent[1];
      VadEvent[1] = 0i64;
      ExAcquirePushLockExclusiveEx(v16 + 40, 0i64);
      *(_DWORD *)(v16 + 24) = *(_DWORD *)(v11 + 24);
      *(_BYTE *)(v16 + 32) = *(_BYTE *)(v11 + 32);
      *(_DWORD *)(v16 + 28) = *(_DWORD *)(v11 + 28);
      *(_BYTE *)(v16 + 33) = *(_BYTE *)(v11 + 33);
    }
    else
    {
      v16 = v25;
    }
    if( (*(_DWORD *)(v11 + 48) & 0x70) == 16 )
      MiDeleteVad((_MMVAD *)v11, v16);
    else
      MiUnmapVad(
        (_MMVAD *)v11,
        v16,
        HIDWORD(a3a),
        v14,
        ImageSize,
        ImageChecksum,
        ImageSignatureLevel,
        ImageSignatureType);
    v17 = 0;
    goto LABEL_13;
  }
  v17 = -1073741799;
LABEL_35:
  MiUnlockAndDereferenceVad((PVOID)v11);
LABEL_13:
  if( v4 == 1 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  if( v5 )
    DbgkUnMapViewOfSection(v26, v5);
  return(unsigned int)v17;
}

Referenced by: