MiEmptyAccessLogs

VOID __stdcall MiEmptyAccessLogs(VOID *Context){
  void *v1; 
  _EPROCESS *i; 
  _LIST_ENTRY *NextProcess; 
  UINT64 v4; 
  _LIST_ENTRY *v5; 
  _MMSUPPORT_INSTANCE *v6; 
  VOID *j; 
  void *NextSession; 
  void *v9; 
  INT64 v10; 
  INT16 v11; 
  _MMSUPPORT_INSTANCE *SessionVm; 
  _MMSUPPORT_INSTANCE *v13; 
  __int64 v14; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  _KAPC_STATE ApcState; 

  memset(&ApcState, 0, sizeof(ApcState));
  memset(&LockHandle, 0, sizeof(LockHandle));
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 330, &LockHandle);
  if( *(&stru_140C4DB30 + 654) )
  {
    *(&stru_140C4DB30 + 326) = 0i64;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
  }
  else
  {
    v1 = 0i64;
    do
    {
      *(&stru_140C4DB30 + 326) = 2i64;
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      for( i = 0i64; ; i = (_EPROCESS *)v5 )
      {
        NextProcess = PsGetNextProcess(i);
        v5 = NextProcess;
        if( !NextProcess )
          break;
        v6 = (_MMSUPPORT_INSTANCE *)&NextProcess[104];
        if( MiGetSharedVm((_MMSUPPORT_INSTANCE *)&NextProcess[104])->AccessLog )
        {
          KiStackAttachProcess(v5, 0i64, &ApcState);
          MiDrainSystemAccessLog(v6);
          KiUnstackDetachProcess(&ApcState, 0i64);
        }
      }
      for( j = 0i64; ; j = v9 )
      {
        NextSession = MiGetNextSession(j, v4);
        v9 = NextSession;
        if( !NextSession )
          break;
        if( MmAttachSession(NextSession, &ApcState) >= 0 )
        {
          SessionVm = MiGetSessionVm(v10, v4, v11);
          MiDrainSystemAccessLog(SessionVm);
          MmDetachSession(v9, &ApcState);
        }
      }
      v13 = (_MMSUPPORT_INSTANCE *)((char *)&stru_140C4DB30 + 4624);
      v14 = 3i64;
      do
      {
        if( v13->MinimumWorkingSetSize )
          MiDrainSystemAccessLog(v13);
        v13 = (_MMSUPPORT_INSTANCE *)((char *)v13 + 320);
        --v14;
      }
      while( v14 );
      MiCheckAndProcessCcAccessLog(0i64, 1ui64);
      KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 330, &LockHandle);
    }
    while( *(&stru_140C4DB30 + 326) != 2i64 );
    if( !*(&stru_140C4DB30 + 654) )
    {
      v1 = (void *)*(&stru_140C4DB30 + 378);
      *(&stru_140C4DB30 + 378) = 0i64;
    }
    *(&stru_140C4DB30 + 326) = 0i64;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    if( v1 )
      ExFreePoolWithTag(v1, 0);
  }
}

Referenced by: