MiDetachProcessFromSession

VOID __stdcall MiDetachProcessFromSession(UINT64 TrimmerThread){
  int v1; 
  _MMPTE *v2; 
  unsigned __int64 Long; 
  int v4; 
  _MM_SESSION_SPACE *Session; 
  __int64 v6; 
  int v7[8]; 
  _KLOCK_QUEUE_HANDLE LockHandle; 

  memset(&LockHandle, 0, sizeof(LockHandle));
  v1 = TrimmerThread;
  v2 = &MmGetPml4eBase()[(qword_140C4DB20 >> 39) & 0x1FF];
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 522, &LockHandle);
  Long = ZeroPte.u.Long;
  LOBYTE(v4) = MiPteInShadowRange((UINT64)v2);
  if( v4 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
    Long = ZeroPte.u.Long | 0x8000000000000000ui64;
  v2->u.Long = Long;
  Session = KeGetCurrentThread()->ApcState.Process->Session;
  if( v1 == 1 )
  {
    v6 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * *((unsigned __int16 *)Session + 215));
    _InterlockedOr(v7, 0);
    *(_DWORD *)(v6 + 6872) = KiTbFlushTimeStamp;
    KeGetCurrentThread()->ApcState.Process->Session = 0i64;
  }
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
}

Referenced by: