MiShutdownSystem

UINT8 __stdcall MiShutdownSystem(){
  INT8 v0; 
  UINT64 v1; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *Lock; 
  INT64 *v4; 
  _ETHREAD *v5; 
  _QWORD *v6; 
  __int64 v7; 
  VOID *Pool; 
  INT64 v9; 
  void *v10; 

  if( !*(&stru_140C4DB30 + 565) )
  {
    CcNotifyWriteBehind(v1);
    MiFlushAllFilesystemPages();
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&stru_140C50B28 + 117, 0i64);
    *(&stru_140C4DB30 + 565) = 1;
    if( (_InterlockedExchangeAdd64((_QWORD *)&stru_140C50B28 + 117, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)&stru_140C50B28 + 117);
    KeAbPostRelease((char *)&stru_140C50B28 + 936);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    KeSetEvent((PRKEVENT)&stru_140C50B28, 0, 0);
    if( *(&stru_140C4DB30 + 2258) == 1 )
    {
      if( (MiFlags & 4) == 0 )
        MmLockPagableSectionByHandle(ExPageLockHandle);
      MiZeroAllPageFiles();
      if( (MiFlags & 4) == 0 )
        MmUnlockPagableImageSection(ExPageLockHandle);
    }
    MiDeleteAllHardwareEnclaves();
  }
  if( *(&stru_140C23628 + 584) )
  {
    Lock = MmAcquireLoadLock(v1, v0);
    v4 = (INT64 *)PsLoadedModuleList;
    v5 = Lock;
    while( v4 != &PsLoadedModuleList )
    {
      v6 = (_QWORD *)v4[17];
      if( v6 != (_QWORD *)1 && v6 != (_QWORD *)-2i64 && ((unsigned __int8)v6 & 1) == 0 )
      {
        v7 = 8i64 * *v6 + 8;
        Pool = MiAllocatePool(64i64, v7, 0x54446D4Dui64);
        v9 = (INT64)Pool;
        if( !Pool )
        {
          *(&stru_140C23628 + 584) = 0;
          break;
        }
        memmove(Pool, v6, v7);
        MiFreeLoadedImportList(v6);
        v4[17] = v9;
      }
      v10 = (void *)v4[10];
      if( v10 )
      {
        ExFreePoolWithTag(v10, 0);
        v4[10] = 0i64;
      }
      v4 = (INT64 *)*v4;
    }
    MmReleaseLoadLock(v5);
    MiDeletePagingFiles(&Irp);
  }
  return 1;
}

Referenced by: