MmDeleteProcessAddressSpace

VOID __stdcall MmDeleteProcessAddressSpace(_EPROCESS *Process){
  _MMSUPPORT_FULL *p_Vm; 
  void *NumberOfLockedPages; 
  char *LockedPagesList; 
  _MMSUPPORT_SHARED *SharedVm; 
  __int64 v6; 
  __int64 v7; 
  UINT64 v8; 
  _EPROCESS *v9; 
  _MI_PARTITION *ProcessPartition; 
  _MMWSL_INSTANCE *VmWorkingSetList; 
  VOID *LockedEntries; 
  _MM_PAGE_ACCESS_INFO_HEADER *AccessLog; 
  void *CommitReleaseContext; 
  _MM_SESSION_SPACE *Session; 
  void *MmHotPatchContext; 
  PVOID *v17; 
  PVOID *v18; 
  PVOID *i; 
  char *j; 
  _QWORD *v21; 
  void *v22; 

  p_Vm = &Process->Vm;
  MiUnlinkWorkingSet(&Process->Vm.Instance, 0i64);
  NumberOfLockedPages = (void *)Process->NumberOfLockedPages;
  LockedPagesList = (char *)Process->LockedPagesList;
  if( NumberOfLockedPages )
  {
    if( LockedPagesList && *((_QWORD *)LockedPagesList + 2) && *((_DWORD *)LockedPagesList + 8) == 1 )
    {
      v17 = *(PVOID **)LockedPagesList;
      v18 = 0i64;
      while( v17 )
      {
        v18 = v17;
        v17 = (PVOID *)*v17;
      }
      if( !v18 )
      {
        for( i = (PVOID *)*((_QWORD *)LockedPagesList + 1); i; i = (PVOID *)*i )
          v18 = i;
      }
      KeBugCheckEx(0xCBu, v18, 0i64, v18[3], (PVOID)Process->NumberOfLockedPages);
    }
    KeBugCheckEx(0x76u, 0i64, Process, NumberOfLockedPages, Process->LockedPagesList);
  }
  if( LockedPagesList )
  {
    for( j = (char *)Process->LockedPagesList; ; j = LockedPagesList + 8 )
    {
      while( 1 )
      {
        v21 = *(_QWORD **)j;
        if( !*(_QWORD *)j )
          break;
        do
        {
          v22 = v21;
          v21 = (_QWORD *)*v21;
        }
        while( v21 );
        if( !v22 )
          break;
        ExFreePoolWithTag(v22, 0);
      }
      if( j != LockedPagesList )
        break;
    }
    ExFreePoolWithTag(LockedPagesList, 0);
  }
  SharedVm = MiGetSharedVm(&p_Vm->Instance);
  LODWORD(v6) = MiDeleteFinalPageTables(Process);
  v7 = v6;
  PsReturnProcessQuota(Process, v8);
  ProcessPartition = MiGetProcessPartition(Process, v9);
  MiReturnResident((INT64)ProcessPartition, 4ui64);
  VmWorkingSetList = Process->Vm.Instance.VmWorkingSetList;
  if( VmWorkingSetList )
  {
    LockedEntries = (VOID *)VmWorkingSetList[9].LockedEntries;
    if( LockedEntries )
      MiDeleteAweInfo((ULONG_PTR)Process, LockedEntries);
    ExCleanupAutoExpandPushLock((_EX_PUSH_LOCK_AUTO_EXPAND *)&VmWorkingSetList[10].NextPteToAge);
  }
  AccessLog = (_MM_PAGE_ACCESS_INFO_HEADER *)SharedVm->AccessLog;
  if( AccessLog )
  {
    MiEmptyPageAccessLog(AccessLog);
    SharedVm->AccessLog = 0i64;
  }
  CommitReleaseContext = SharedVm->CommitReleaseContext;
  if( CommitReleaseContext )
  {
    ExFreePoolWithTag(CommitReleaseContext, 0);
    SharedVm->CommitReleaseContext = 0i64;
  }
  if( (Process->Flags2 & 0x10) != 0 )
    PspChangeJobMemoryUsageByProcess(2ui64, -4i64, Process, 0i64);
  MiReturnCommit(ProcessPartition, 4 - v7);
  MiDeletePxeSharedLocks((INT64)p_Vm);
  MiDeleteWorkingSetList((INT64)p_Vm);
  Session = Process->Session;
  if( Session )
    MiReleaseProcessReferenceToSessionDataPage(Session);
  MmHotPatchContext = Process->MmHotPatchContext;
  if( MmHotPatchContext )
    ExFreePoolWithTag(MmHotPatchContext, 0);
  MiContractPagingFiles(ProcessPartition);
}

Referenced by: