MiEmptyAccessLogs

VOID __stdcall MiEmptyAccessLogs(PVOID Context){
  PSLIST_ENTRY v1; 
  void *i; 
  __int64 NextProcess; 
  UINT64 v4; 
  _KPROCESS *v5; 
  INT64 v6; 
  INT64 v7; 
  UINT8 *v8; 
  void *j; 
  void *v10; 
  INT64 v11; 
  UINT8 *v12; 
  void *v13; 
  __int64 SessionVm; 
  INT64 v15; 
  UINT8 *v16; 
  INT64 *v17; 
  __int64 v18; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  _KAPC_STATE ApcState; 
  memset(&ApcState, 0, sizeof(ApcState));
  memset(&LockHandle, 0, sizeof(LockHandle));
  KeAcquireInStackQueuedSpinLock(&qword_140C4E580, &LockHandle);
  if( (_DWORD)dword_140C4E568 )
  {
    stru_140C4E548.Parameter = 0i64;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
  }
  else
  {
    v1 = 0i64;
    do
    {
      stru_140C4E548.Parameter = (void *)2;
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      for( i = 0i64; ; i = v5 )
      {
        NextProcess = PsGetNextProcess(i);
        v5 = (_EPROCESS *)NextProcess;
        if( !NextProcess )
          break;
        v6 = NextProcess + 1664;
        if( MiGetSharedVm(NextProcess + 1664)[5] )
        {
          KiStackAttachProcess((_KPROCESS *)v5, 0i64, &ApcState);
          MiDrainSystemAccessLog(v6, v7, v8);
          KiUnstackDetachProcess(&ApcState, 0i64);
        }
      }
      for( j = 0i64; ; j = v13 )
      {
        LODWORD(v10) = MiGetNextSession(j, v4);
        v13 = v10;
        if( !v10 )
          break;
        if( MmAttachSession(v10, &ApcState) >= 0 )
        {
          SessionVm = MiGetSessionVm();
          MiDrainSystemAccessLog(SessionVm, v15, v16);
          MmDetachSession(v13, &ApcState);
        }
      }
      v17 = &qword_140C4ED40;
      v18 = 3i64;
      do
      {
        if( v17[14] )
          MiDrainSystemAccessLog((INT64)v17, v11, v12);
        v17 += 40;
        --v18;
      }
      while( v18 );
      MiCheckAndProcessCcAccessLog(0i64, 1i64);
      KeAcquireInStackQueuedSpinLock(&qword_140C4E580, &LockHandle);
    }
    while( stru_140C4E548.Parameter != (void *)2 );
    if( !(_DWORD)dword_140C4E568 )
    {
      v1 = P;
      P = 0i64;
    }
    stru_140C4E548.Parameter = 0i64;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    if( v1 )
      ExFreePoolWithTag(v1, 0);
  }
}

Referenced by: