MiScrubProcessLargePages

VOID __stdcall MiScrubProcessLargePages(SECONDARY_INTERRUPT_MASK *a1){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  unsigned int LargePrivateVadCount; 
  _QWORD *v4; 
  _QWORD *v5; 
  _RTL_BALANCED_NODE *Root; 
  _QWORD *Children; 
  unsigned int v8; 
  _QWORD **v9; 
  INT64 v10; 
  _QWORD *v11; 
  _QWORD *v12; 
  int v13; 
  _QWORD *Pool; 
  __int64 v15; 
  NTSTATUS v16; 
  __int64 *v17; 
  unsigned int i; 
  __int64 v19; 
  _KEVENT *v20; 
  _QWORD *v22; 
  _QWORD *v23; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = CurrentThread->Tcb.ApcState.Process;
  --CurrentThread->Tcb.KernelApcDisable;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockSharedEx(&Process->AddressCreationLock, 0i64);
  CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 2u;
  if( (Process->Flags & 0x20) != 0 )
  {
    UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
  }
  else
  {
    LargePrivateVadCount = Process->LargePrivateVadCount;
    v4 = 0i64;
    v22 = 0i64;
    v5 = 0i64;
    Root = Process->VadRoot.Root;
    Children = 0i64;
    v8 = 13;
    while( Root )
    {
      Children = Root->Children;
      Root = Root->Children[0];
    }
    while( LargePrivateVadCount && Children )
    {
      v9 = (_QWORD **)Children[1];
      v10 = (INT64)Children;
      v11 = Children;
      if( v9 )
      {
        v12 = *v9;
        for( Children = (_QWORD *)Children[1]; v12; v12 = (_QWORD *)*v12 )
          Children = v12;
      }
      else
      {
        while( 1 )
        {
          Children = (_QWORD *)(Children[2] & 0xFFFFFFFFFFFFFFFCui64);
          if( !Children || (_QWORD *)*Children == v11 )
            break;
          v11 = Children;
        }
      }
      LOBYTE(v13) = MiIsVadLargePrivate(v10);
      if( v13 && (*(_DWORD *)(v10 + 48) & 0x500000) != 5242880 )
      {
        --CurrentThread->Tcb.SpecialApcDisable;
        ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(v10 + 40), 0i64);
        CurrentThread->_bf_1 |= 0x40u;
        if( (*(_DWORD *)(v10 + 48) & 4) != 0 )
        {
          MiUnlockVadShared(&CurrentThread->Tcb, (_EX_PUSH_LOCK *)v10);
        }
        else
        {
          if( v8 >= 0xD )
          {
            Pool = MiAllocatePool(256i64, 0x70ui64, 0x7356694Dui64);
            v4 = Pool;
            if( !Pool )
            {
              MiUnlockVadShared(&CurrentThread->Tcb, (_EX_PUSH_LOCK *)v10);
              break;
            }
            v8 = 0;
            if( v5 )
              *v22 = Pool;
            else
              v5 = Pool;
            v22 = Pool;
          }
          v15 = v8++;
          v4[v15 + 1] = v10;
          if( !_InterlockedIncrement((volatile signed __int32 *)(v10 + 36)) )
            __fastfail(0xEu);
          MiUnlockVadShared(&CurrentThread->Tcb, (_EX_PUSH_LOCK *)v10);
          --LargePrivateVadCount;
        }
      }
    }
    UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
    v16 = 1;
    if( v5 )
    {
      do
      {
        v17 = v5 + 1;
        v23 = (_QWORD *)*v5;
        for( i = 0; i < 0xD; ++i )
        {
          v19 = *v17;
          if( !*v17 )
            break;
          --CurrentThread->Tcb.SpecialApcDisable;
          ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(v19 + 40), 0i64);
          CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 0x80u;
          if( (*(_DWORD *)(v19 + 48) & 4) == 0 && v16 == 1 )
            v16 = MiScrubLargeMappedPage((_MMVAD *)a1, (_MISCRUB_PACKET *)Process, (_EPROCESS *)v19, v20);
          MiUnlockAndDereferenceVad((_MMVAD_SHORT *)v19);
          ++v17;
        }
        ExFreePoolWithTag(v5, 0);
        v5 = v23;
      }
      while( v23 );
    }
  }
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
}

Referenced by: