MmCleanProcessAddressSpace

VOID __stdcall MmCleanProcessAddressSpace(_EPROCESS *Process){
  UINT64 v1; 
  unsigned int Flags; 
  unsigned int v4; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v6; 
  _MI_PARTITION *v7; 
  _MMWSL_INSTANCE *VmWorkingSetList; 
  _MI_PARTITION *v9; 
  int v10; 
  _RTL_BALANCED_NODE *Root; 
  _MMVAD *i; 
  _MMVAD **ExtraCreateInfo; 
  _MMVAD *v14; 
  _MMVAD *v15; 
  _MMVAD *NextVad; 
  int v17; 
  _BOOL8 v18; 
  _EX_CALLBACK_ROUTINE_BLOCK *LockedEntries; 
  _EWOW64PROCESS *WoW64Process; 
  UINT64 v21; 
  UINT64 v22; 
  UINT64 v23; 
  bool v24; 
  _EPROCESS *v25; 
  _MI_PARTITION *ProcessPartition; 
  signed __int32 bf_0; 
  signed __int32 v28; 
  UINT64 v29; 
  __int128 Object; 
  __int64 v31; 
  NTSTATUS v32; 

  Flags = Process->Flags;
  Object = 0i64;
  v31 = 0i64;
  if( (Flags & 0x20) == 0 )
  {
    v4 = Flags & 0xC00;
    if( v4 > 0x400 )
    {
      if( v4 != 2048 )
        goto LABEL_4;
      PsReturnProcessQuota(Process, v1);
      ProcessPartition = MiGetProcessPartition(Process, v25);
      MiReturnResident((INT64)ProcessPartition, Process->Vm.Instance.MinimumWorkingSetSize - 4);
      bf_0 = Process->$1F247424BFCF625481CFD4988DD60FD2::_bf_0;
      do
      {
        v28 = bf_0;
        bf_0 = _InterlockedCompareExchange((volatile signed __int32 *)&Process->1124, bf_0 & 0xFFFFF3FF | 0x400, bf_0);
      }
      while( v28 != bf_0 );
      v24 = (Process->Flags & 0x10000) == 0;
LABEL_39:
      if( !v24 )
        MiDereferenceSession();
      return;
    }
LABEL_38:
    v24 = (Flags & 0x10000) == 0;
    goto LABEL_39;
  }
  if( (Process->Vm.Instance.Flags._bf_0 & 0x60) != 96 )
    goto LABEL_38;
LABEL_4:
  KeInitializeEvent((INT64)&Object, 0, 0);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v32 = MiBeginProcessClean(CurrentThread, Process);
  v7 = MiGetProcessPartition(Process, v6);
  VmWorkingSetList = Process->Vm.Instance.VmWorkingSetList;
  v9 = v7;
LABEL_5:
  while( 1 )
  {
    v10 = 0;
    LOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
    Root = Process->VadRoot.Root;
    i = 0i64;
    while( Root )
    {
      i = (_MMVAD *)Root;
      Root = Root->Children[0];
    }
    if( !i )
      break;
    MiReferenceVad(&i->Core);
    while( 1 )
    {
      ExtraCreateInfo = (_MMVAD **)i->Core.ExtraCreateInfo;
      v14 = i;
      v15 = i;
      if( ExtraCreateInfo )
      {
        NextVad = *ExtraCreateInfo;
        for( i = (_MMVAD *)i->Core.ExtraCreateInfo; NextVad; NextVad = (_MMVAD *)NextVad->Core.NextVad )
          i = NextVad;
      }
      else
      {
        while( 1 )
        {
          i = (_MMVAD *)(i->Core.VadNode.ParentValue & 0xFFFFFFFFFFFFFFFCui64);
          if( !i || (_MMVAD *)i->Core.NextVad == v15 )
            break;
          v15 = i;
        }
      }
      if( i )
        MiReferenceVad(&i->Core);
      UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
      MiLockVad(CurrentThread, &v14->Core);
      MiCleanVad(v14);
      if( v17 )
        v10 = 1;
      LOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
      if( !i )
        break;
      MiLockVad(CurrentThread, &i->Core);
      if( MiVadDeleted(&i->Core) )
      {
        MiUnlockVad(CurrentThread, &i->Core);
        UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
        MiLockVad(CurrentThread, &i->Core);
        MiCleanVad(i);
        goto LABEL_5;
      }
      MiUnlockVad(CurrentThread, &i->Core);
    }
    if( !v10 )
      break;
    UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
  }
  VmWorkingSetList[7].LockedEntries = (unsigned __int64)&Object;
  v18 = _InterlockedAdd((volatile signed __int32 *)&VmWorkingSetList[7], 0xFFFFFFFF) != 0;
  UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
  if( v18 )
    KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
  if( (Process->Vm.Instance.Flags._bf_0 & 0x60) == 96 )
    MiClearCommitReleaseState(&Process->Vm.Instance);
  ExFreeSvmAsid();
  MiCleanCfg();
  LOCK_ADDRESS_SPACE(CurrentThread, Process);
  VmWorkingSetList[7].LockedEntries = 0i64;
  LockedEntries = (_EX_CALLBACK_ROUTINE_BLOCK *)Process->Vm.Instance.VmWorkingSetList[9].LockedEntries;
  if( LockedEntries )
  {
    LODWORD(v29) = MiDeleteAweInfoPages(LockedEntries);
    if( v29 )
    {
      Process->VadPhysicalPages = 0i64;
      MiReturnProcessCommitment(Process, v29);
    }
  }
  WoW64Process = Process->WoW64Process;
  if( WoW64Process && WoW64Process->Peb )
    WoW64Process->Peb = 0i64;
  MiDeleteCloneZombies((INT64)Process, 0i64);
  LODWORD(v21) = MiCleanWorkingSet(Process);
  v22 = v21;
  UNLOCK_ADDRESS_SPACE(CurrentThread, Process);
  PsReturnProcessQuota(Process, v23);
  MiReturnResident((INT64)v9, v22);
  if( (Process->Flags & 0x10000) != 0 )
    MiDereferenceSession();
  if( v32 )
    MiContractWsSwapPageFile(v9);
}

Referenced by: