MmFlushImageSection
VOID __fastcall MmFlushImageSection(_SECTION_OBJECT_POINTERS *SectionObjectPointers, _MMFLUSH_TYPE FlushType){
unsigned __int64 v4;
INT64 *DataSectionObject;
INT64 *ImageSectionObject;
while( 1 )
{
v4 = ExAcquireSpinLockExclusive(&dword_140C4C6C0);
if( FlushType == MmFlushForDelete )
{
DataSectionObject = (INT64 *)SectionObjectPointers->DataSectionObject;
if( SectionObjectPointers->DataSectionObject )
{
if( !(unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel(DataSectionObject + 9) )
goto LABEL_14;
if( DataSectionObject[6] || (DataSectionObject[7] & 2) != 0 || (unsigned __int64)DataSectionObject[14] > 1 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4C6C0);
ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
goto LABEL_5;
}
ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
}
}
ImageSectionObject = (INT64 *)SectionObjectPointers->ImageSectionObject;
if( !ImageSectionObject )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4C6C0);
LABEL_5:
__writecr8(v4);
return;
}
if( (unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel(ImageSectionObject + 9) )
break;
LABEL_14:
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4C6C0);
__writecr8(v4);
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4C6C0);
MiAttemptSectionDelete((__int64)ImageSectionObject, v4, 0);
}Referenced by:
MiCanFileBeTruncatedInternal