MiScrubProcesses

NTSTATUS __stdcall MiScrubProcesses(_MI_PARTITION *Partition, _KEVENT *StopEvent, UINT64 *PagesScrubbed){
  UINT64 v5; 
  _KEVENT *v6; 
  _MISCRUB_PACKET *v7; 
  NTSTATUS result; 
  _EPROCESS *i; 
  int v10; 
  int v11; 
  void *v12; 
  _LIST_ENTRY *NextProcess; 
  _EPROCESS *v14; 
  INT64 v15; 
  INT64 OpaqueParameter; 
  int v17; 
  _DWORD v18[53]; 
  _KAPC_STATE ApcState; 

  memset(&ApcState, 0, sizeof(ApcState));
  memset(v18, 0i64, sizeof(v18));
  v17 = -1;
  OpaqueParameter = (INT64)Partition;
  result = MiInitializeScrubPacket((_MI_PARTITION *)&OpaqueParameter, v5, v6, v7);
  if( result >= 0 )
  {
    for( i = 0i64; ; i = (_EPROCESS *)v15 )
    {
      NextProcess = PsGetNextProcess(i);
      v15 = (INT64)NextProcess;
      if( !NextProcess )
        break;
      if( MiGetProcessPartition(NextProcess, v14) == (_MI_PARTITION *)Partition->Core.PfnUnmapWorkItem.List.Flink )
      {
        LOBYTE(v10) = MiScrubInterrupted((INT64)&OpaqueParameter);
        if( v10 )
          break;
        LOBYTE(v11) = MiProcessHasAwePrivatePages(v15);
        if( v11 || *(_DWORD *)(v15 + 2140) )
        {
          KiStackAttachProcess(v12, 0i64, &ApcState);
          MiScrubProcessLargePages((SECONDARY_INTERRUPT_MASK *)&OpaqueParameter);
          MiScrubProcessPhysicalPages(&OpaqueParameter);
          KiUnstackDetachProcess(&ApcState, 0i64);
        }
      }
    }
    *(_QWORD *)StopEvent = *(_QWORD *)&v18[49];
    MiReleaseScrubPacket((_MISCRUB_PACKET *)&OpaqueParameter);
    return 0;
  }
  return result;
}

Referenced by: