MiDereferenceSessionFinal

VOID __stdcall MiDereferenceSessionFinal(){
  UINT64 v0; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  __int64 Session; 
  _MI_PARTITION *v4; 
  _MI_PARTITION *v5; 
  __int64 v6; 
  INT64 v7; 
  void *v8; 
  void *v9; 
  UINT64 v10; 
  void(__fastcall *v11)(_QWORD); 
  _ETHREAD *v12; 
  INT64 v13; 
  INT64 v14; 
  INT64 v15; 
  INT64 v16; 
  int v17; 
  _MM_SESSION_SPACE *v18; 
  VOID *v19; 
  _MI_DELETE_VA_INFO DeleteInfo; 
  __int128 v21; 
  __int128 v22; 
  int v23; 

  DeleteInfo = 0i64;
  v21 = 0i64;
  v22 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = CurrentThread->Tcb.ApcState.Process;
  Session = (__int64)Process->Session;
  LODWORD(v4) = MiPartitionIdToPointer(*(_WORD *)(Session + 430), v0);
  v5 = v4;
  MiMarkSessionDeletePending(Session, v6, v7);
  if( *(_QWORD *)(Session + 80) )
  {
    KeSetEvent(*(PRKEVENT *)(Session + 72), 1, 0);
    ObCloseHandle(*(VOID **)(Session + 80), 0);
  }
  v11 = *(void(__fastcall **)(_QWORD))(Session + 680);
  if( (unsigned __int64)v11 > 1 )
    v11(0i64);
  MiSessionUnloadAllImages(v9, v8, v10);
  MiUnlinkSessionWorkingSet((_MM_SESSION_SPACE *)Session);
  v23 = *(_DWORD *)(Session + 8);
  v12 = (_ETHREAD *)KeGetCurrentThread();
  --v12->Tcb.KernelApcDisable;
  ExpWnfDeleteScopeById((_KSPIN_LOCK *)1, &v23, 4u);
  KeLeaveCriticalRegion();
  MiFreeSessionSpaceMap();
  v17 = *(_DWORD *)(Session + 4);
  if( (v17 & 1) != 0 )
  {
    ExCleanupSessionHeapManager(v14, v13, v15, v16);
    *(_DWORD *)(Session + 4) |= 0x100u;
    MiCheckSessionPoolAllocations();
    v17 = *(_DWORD *)(Session + 4);
  }
  if( (v17 & 0x180) == 128 )
    ExCleanupSessionHeapManager(v14, v13, v15, v16);
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx(&Lock, 0i64);
  *(_DWORD *)(Session + 4) |= 0x20u;
  if( (_InterlockedExchangeAdd64(&Lock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&Lock);
  KeAbPostRelease(&Lock);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( Process->SessionProcessLinks.Flink )
  {
    MiSessionUnlinkProcess(v18, Process);
    Process->SessionProcessLinks.Flink = 0i64;
  }
  MiDeleteSessionAddressSpace((_MM_SESSION_SPACE *)Session, &DeleteInfo);
  MiDetachProcessFromSession(0i64);
  MiReturnCommit(v5, *((_QWORD *)&v21 + 1) - *(_QWORD *)&DeleteInfo.ReducedCommitClonePages);
  MiReturnResident((INT64)v5, *(UINT64 *)&DeleteInfo.ResidentPages);
  MiReturnResident((INT64)v5, *(_QWORD *)(Session + 368));
  v19 = *(VOID **)(Session + 1048);
  if( v19 )
    ObfDereferenceObjectWithTag(v19, 0x73536D4Dui64);
  *(_QWORD *)(Session + 1048) = 0i64;
}

Referenced by: