MiScrubProcessPhysicalPages
VOID __stdcall MiScrubProcessPhysicalPages(PVOID OpaqueParameter){
_ETHREAD *CurrentThread;
__int64 v3;
__int64 v4;
INT64 v5;
unsigned __int64 v6;
UINT64 v7;
INT64 v8;
BOOL v9;
UINT64 SetBits;
unsigned __int64 v11;
INT64 v12;
char *v13;
unsigned __int64 i;
unsigned __int64 v15;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = *((_QWORD *)CurrentThread + 23);
MiLockAweVadsExclusive((INT64)CurrentThread);
v4 = *(_QWORD *)(v3 + 1680);
v5 = *(_QWORD *)(v4 + 392);
if( v5 )
{
v15 = ExGetCallBackBlockRoutine(*(_QWORD *)(v4 + 392));
v6 = v15;
v7 = 0i64;
MiLockAwePagesExclusive(v8, (INT64)CurrentThread);
v9 = MiScrubInterrupted((INT64)OpaqueParameter);
while( !v9 )
{
SetBits = RtlFindSetBitsEx((UINT64 *)(v5 + 16), 1ui64, v7);
v11 = SetBits;
if( SetBits < v7 || SetBits == -1i64 )
break;
v12 = SetBits * v6;
v13 = (char *)MmGetPfnDb() + 48 * v12;
for( i = 0i64; i < v15; ++i )
{
if( (int)MiScrubAwePage((UINT64 *)OpaqueParameter, v12, (_DWORD *)v5) < 0 )
MiMakePageBad((UINT64)v13, 1);
MiUnlockAwePagesExclusive(v5, (INT64)CurrentThread);
MiUnlockAweVadsExclusive((__int64)CurrentThread);
++v12;
v13 += 48;
MiLockAweVadsExclusive((INT64)CurrentThread);
MiLockAwePagesExclusive(v5, (INT64)CurrentThread);
if( !_bittest64(*(const signed __int64 **)(v5 + 24), v11) )
break;
}
v7 = v11 + 1;
if( v11 + 1 >= *(_QWORD *)(v5 + 16) )
break;
v9 = MiScrubInterrupted((INT64)OpaqueParameter);
v6 = v15;
}
MiUnlockAwePagesExclusive(v5, (INT64)CurrentThread);
}
MiUnlockAweVadsExclusive((__int64)CurrentThread);
}Referenced by:
MiScrubProcesses