MmDeleteProcessAddressSpace

VOID __stdcall MmDeleteProcessAddressSpace(_EPROCESS *Process){
  char *v1; 
  ULONG_PTR v3; 
  char *v4; 
  INT64 *SharedVm; 
  __int64 v6; 
  __int64 v7; 
  INT64 v8; 
  _MI_PARTITION *v9; 
  INT64 v10; 
  __int64 v11; 
  _QWORD *v12; 
  UINT64 *v13; 
  void *v14; 
  unsigned __int64 v15; 
  void *v16; 
  _QWORD *v17; 
  ULONG_PTR v18; 
  _QWORD *i; 
  char *j; 
  _QWORD *v21; 
  void *v22; 
  v1 = (char *)Process + 1664;
  MiUnlinkWorkingSet((_MMSUPPORT_INSTANCE *)((char *)Process + 1664), 0i64);
  v3 = *((_QWORD *)Process + 160);
  v4 = (char *)*((_QWORD *)Process + 193);
  if( v3 )
  {
    if( v4 && *((_QWORD *)v4 + 2) && *((_DWORD *)v4 + 8) == 1 )
    {
      v17 = *(_QWORD **)v4;
      v18 = 0i64;
      while( v17 )
      {
        v18 = (ULONG_PTR)v17;
        v17 = (_QWORD *)*v17;
      }
      if( !v18 )
      {
        for( i = (_QWORD *)*((_QWORD *)v4 + 1); i; i = (_QWORD *)*i )
          v18 = (ULONG_PTR)i;
      }
      KeBugCheckEx(0xCBu, v18, 0i64, *(_QWORD *)(v18 + 24), *((_QWORD *)Process + 160));
    }
    KeBugCheckEx(0x76u, 0i64, (ULONG_PTR)Process, v3, *((_QWORD *)Process + 193));
  }
  if( v4 )
  {
    for( j = (char *)*((_QWORD *)Process + 193); ; j = v4 + 8 )
    {
      while( 1 )
      {
        v21 = *(_QWORD **)j;
        if( !*(_QWORD *)j )
          break;
        do
        {
          v22 = v21;
          v21 = (_QWORD *)*v21;
        }
        while( v21 );
        if( !v22 )
          break;
        ExFreePoolWithTag(v22, 0);
      }
      if( j != v4 )
        break;
    }
    ExFreePoolWithTag(v4, 0);
  }
  SharedVm = MiGetSharedVm((INT64)v1);
  v6 = MiDeleteFinalPageTables((ULONG_PTR)Process);
  PsReturnProcessQuota((ULONG_PTR)Process, v7, 4ui64);
  MiGetProcessPartition(Process);
  v9 = (_MI_PARTITION *)v8;
  MiReturnResident(v8, 4ui64);
  v11 = *((_QWORD *)Process + 210);
  if( v11 )
  {
    v12 = *(_QWORD **)(v11 + 392);
    if( v12 )
      MiDeleteAweInfo((ULONG_PTR)Process, v12, v10);
    ExCleanupAutoExpandPushLock(v11 + 408, (INT64)v12, v10);
  }
  v13 = (UINT64 *)SharedVm[5];
  if( v13 )
  {
    MiEmptyPageAccessLog(v13);
    SharedVm[5] = 0i64;
  }
  v14 = (void *)SharedVm[4];
  if( v14 )
  {
    ExFreePoolWithTag(v14, 0);
    SharedVm[4] = 0i64;
  }
  if( (*((_DWORD *)Process + 280) & 0x10) != 0 )
    PspChangeJobMemoryUsageByProcess(2, -4i64, (__int64)Process, 0i64);
  MiReturnCommit(v9, 4 - v6);
  MiDeletePxeSharedLocks((INT64)v1);
  MiDeleteWorkingSetList((INT64)v1);
  v15 = *((_QWORD *)Process + 171);
  if( v15 )
    MiReleaseProcessReferenceToSessionDataPage(v15);
  v16 = (void *)*((_QWORD *)Process + 319);
  if( v16 )
    ExFreePoolWithTag(v16, 0);
  MiContractPagingFiles(v9);
}

Referenced by: