MmOutSwapProcess

VOID __stdcall MmOutSwapProcess(_EPROCESS *Process){
  LONG *v1; 
  __int64 v2; 
  char v4; 
  char v5; 
  _QWORD *v6; 
  __int64 v7; 
  _QWORD *v8; 
  UINT64 *v9; 
  UINT64 v10; 
  char *v11; 
  __int64 v12; 
  INT64 *v13; 
  UINT64 v14; 
  INT64 TransitionPte; 
  unsigned __int64 v16; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  __int16 PcValue; 
  char v19; 
  char v20; 
  int v21; 
  __int64 v22[2]; 
  UINT8 OldIrql; 
  UINT64 SpinCount; 
  UINT64 v25; 
  v1 = &dword_140C4F4C0;
  v2 = *((_BYTE *)Process + 1848) & 7;
  v20 = 0;
  OldIrql = 0;
  memset(&LockHandle, 0, sizeof(LockHandle));
  if( (_BYTE)v2 != 2 )
    v1 = (LONG *)((char *)Process + 1856);
  _InterlockedOr((volatile signed __int32 *)Process + 281, 0x40u);
  v4 = *((_BYTE *)Process + 1851);
  if( (v4 & 0x60) == 32 )
  {
    MiReleaseOutSwappedProcessCommit(Process);
  }
  else if( (v4 & 0x60) == 64 && *(_QWORD *)(*((_QWORD *)v1 + 4) + 40i64) )
  {
    MiReleaseCommitForResetPages(Process);
  }
  if( *((_QWORD *)Process + 225) == 1i64 && (*((_BYTE *)Process + 1851) & 2) == 0 )
  {
    PcValue = 263;
    v22[1] = (__int64)v22;
    v19 = 6;
    v22[0] = (__int64)v22;
    v21 = 0;
    KeAcquireInStackQueuedSpinLock(&WorkerRoutine, &LockHandle);
    while( 1 )
    {
      v5 = *((_BYTE *)Process + 1849) >> 4;
      if( (*((_BYTE *)Process + 1849) & 6) == 0 && !v5 )
        break;
      if( v5 )
      {
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
        v16 = LockHandle.OldIrql;
        goto LABEL_31;
      }
      *((_QWORD *)Process + 221) = &PcValue;
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      KeWaitForGate(&PcValue, 18);
      KeAcquireInStackQueuedSpinLock(&WorkerRoutine, &LockHandle);
      *((_QWORD *)Process + 221) = 0i64;
    }
    _InterlockedOr((volatile signed __int32 *)Process + 281, 0x80u);
    v6 = (_QWORD *)((char *)Process + 1688);
    v7 = *((_QWORD *)Process + 211);
    v8 = (_QWORD *)*((_QWORD *)Process + 212);
    if( *(_EPROCESS **)(v7 + 8) != (_EPROCESS *)((char *)Process + 1688) || (_QWORD *)*v8 != v6 )
      __fastfail(3u);
    *v8 = v7;
    *(_QWORD *)(v7 + 8) = v8;
    *v6 = 0i64;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    v9 = (UINT64 *)*((_QWORD *)v1 + 5);
    if( v9 )
    {
      MiEmptyPageAccessLog(v9);
      *((_QWORD *)v1 + 5) = 0i64;
    }
    LODWORD(SpinCount) = 0;
    while( !(unsigned int)KeIsEmptyAffinityEx((_WORD *)Process + 184) )
      KeYieldProcessorEx(&SpinCount);
    KeFlushProcessTb(*((_QWORD *)Process + 5));
    if( *((_QWORD *)Process + 241) )
      KeFlushProcessTb(*((_QWORD *)Process + 113));
    v10 = *((_QWORD *)Process + 5) >> 12;
    v11 = (char *)MmGetPfnDb() + 48 * v10;
    LODWORD(v12) = MiMapPageInHyperSpaceWorker(v10, &OldIrql, 0x80000000ui64);
    v13 = (INT64 *)(v12 + 8i64 * ((*((_DWORD *)v11 + 2) >> 3) & 0x1FF));
    TransitionPte = MiMakeTransitionPte(v10, 4ui64, v14);
    *v13 = TransitionPte;
    MiUnmapPageInHyperSpaceWorker(v13, OldIrql, 0x80000000ui64);
    MiLockAndDecrementShareCount((UINT64)v11, 0);
    KeAcquireInStackQueuedSpinLock(&WorkerRoutine, &LockHandle);
    LODWORD(v25) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)v11 + 6, 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&v25);
      while( *((__int64 *)v11 + 3) < 0 );
    }
    *((_QWORD *)v11 + 1) = (char *)Process + 1432;
    *((_QWORD *)Process + 179) = TransitionPte;
    *((_QWORD *)Process + 223) = 0i64;
    *((_QWORD *)Process + 224) = 0i64;
    *((_QWORD *)Process + 225) = 0i64;
    *((_QWORD *)Process + 226) = 0i64;
    MiDecrementShareCount((UINT64)v11);
    _InterlockedAnd64((volatile signed __int64 *)v11 + 3, 0x7FFFFFFFFFFFFFFFui64);
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    v16 = LockHandle.OldIrql;
LABEL_31:
    __writecr8(v16);
  }
}

Referenced by: