MiTrimWorkingSetTail

NTSTATUS __stdcall MiTrimWorkingSetTail(INT64 a1){
  INT64 v1; 
  UINT64 i; 
  _DWORD *v4; 
  __int64 v6; 
  __int64 v7; 
  int v8; 

  v1 = *(_QWORD *)(a1 + 24);
  for( i = *(_QWORD *)(a1 + 168);
        ;
        MiProcessVmAccessedInfo(
          a1,
          *(_DWORD **)(i + 240),
          (__int64(__fastcall *)(__int64, _QWORD *, char *, unsigned __int64, __int64))MiTrimWorkingSetEPTCallback,
          i) )
  {
    MiTrimWorkingSetBuildup((_MMMOD_WRITER_MDL_ENTRY *)a1, i);
    if( (*(_DWORD *)i & 0x80u) != 0 )
    {
      v6 = *(_QWORD *)(i + 16) - *(_QWORD *)(i + 24);
      *(_QWORD *)(v1 + 8) += v6;
      *(_QWORD *)(i + 24) = *(_QWORD *)(i + 16);
      v7 = *(_QWORD *)(*(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * *(unsigned __int16 *)(v1 + 174)) + 6848i64);
      *(_QWORD *)(v7 + 8i64 * (*(_DWORD *)i & 0xF) + 2584) += v6;
    }
    v4 = *(_DWORD **)(i + 240);
    if( !v4 || !*v4 || !MiQueryEPTAccessedState(a1, v4) )
      break;
  }
  if( (*(_DWORD *)i & 0x800) != 0 && (LOBYTE(v8) = MiTrimmedEnough(v1, i), v8) )
    return 4;
  else
    return 0;
}

Referenced by: