MiScanPagefileSpace

VOID __stdcall MiScanPagefileSpace(PVOID Context){
  __int16 v1; 
  int v2; 
  PHYSICAL_MEMORY_DESCRIPTOR *v4; 
  _MMPFN *v5; 
  _MMPFN *v6; 
  char *v7; 
  unsigned __int64 v8; 
  char v9; 
  UINT64 v10; 
  UINT8 v11; 
  char v12; 
  INT64 v13; 
  INT64 v14; 
  INT64 v15; 
  INT64 v16; 
  INT64 v17; 
  INT64 v18; 
  INT64 v19; 
  INT64 v20; 
  INT64 v21; 
  INT64 v22; 
  UINT8 OldIrql; 
  __int16 v24; 
  int v25; 
  PHYSICAL_MEMORY_DESCRIPTOR *v26; 
  v1 = *(_WORD *)Context;
  v24 = *(_WORD *)Context;
  v2 = 0;
  v25 = 0;
  v4 = MiReferencePageRuns((_MI_PARTITION *)Context, 0i64);
  v26 = v4;
  do
  {
    v5 = (_MMPFN *)((char *)MmGetPfnDb() + 48 * v4->Run[v2].BasePage);
    v6 = (_MMPFN *)((char *)v5 + 48 * v4->Run[v2].PageCount);
    if( v5 < v6 )
    {
      v7 = (char *)v5 + 16;
      do
      {
        v8 = *((_QWORD *)v7 + 3);
        if( ((v8 >> 39) & 0x3FF) == v1 )
        {
          v9 = v7[18];
          if( (((v9 & 7) - 2) & 0xFA) == 0
            && (v9 & 7) != 6
            && (*(_DWORD *)v7 & 0x400i64) == 0
            && (unsigned int)MiGetPagingFileOffset((MMPTE *)v7)
            && (v8 & 0xFFFFFFFFFi64) != 0xFFFFFFFFDi64
            && *((_WORD *)v7 + 8)
            && (v9 & 0x28) == 0
            && (v7[19] & 0x10) == 0 )
          {
            v10 = 0i64;
            v11 = MiLockPage((INT64)v5);
            v12 = v7[18];
            OldIrql = v11;
            if( (((v12 & 7) - 2) & 0xFA) == 0
              && (v12 & 7) != 6
              && (*(_DWORD *)v7 & 0x400i64) == 0
              && (unsigned int)MiGetPagingFileOffset((MMPTE *)v7)
              && (*((_QWORD *)v7 + 3) & 0xFFFFFFFFFi64) != 0xFFFFFFFFDi64
              && *((_WORD *)v7 + 8)
              && (((v12 & 0x28) == 0) & (unsigned __int8)~((unsigned __int8)v7[19] >> 4)) != 0 )
            {
              v10 = MiCaptureDirtyBitToPfn((INT64)v5);
            }
            MiUnlockPage(v5, OldIrql);
            if( v10 )
              MiReleasePageFileInfo((INT64)Context, v10, 0, v13, v15, v16, v17, v18, v19, v20, v21, v22);
          }
          v1 = v24;
        }
        v5 = (_MMPFN *)((char *)v5 + 48);
        v7 += 48;
      }
      while( v5 < v6 );
      v2 = v25;
      v4 = v26;
    }
    v25 = ++v2;
  }
  while( v2 != v4->NumberOfRuns );
  MiDereferencePageRuns(v4);
  v14 = *((_QWORD *)Context + 22);
  *((_QWORD *)Context + 123) = 0i64;
  PsDereferencePartition(v14);
}

Referenced by: