MiDrainSystemAccessLog
INT64 __fastcall MiDrainSystemAccessLog(INT64 a1, INT64 a2, UINT8 *a3){
void *v3;
INT64 result;
char v5;
UINT64 **v6;
unsigned __int8 CurrentIrql;
unsigned __int64 *v8;
struct _KLOCK_QUEUE_HANDLE LockHandle;
result = a1;
v5 = *(_BYTE *)(a1 + 184) & 7;
*(_QWORD *)&LockHandle.OldIrql = 0i64;
if( v5 == 2 )
v6 = (UINT64 **)qword_140C4F4E8;
else
v6 = (UINT64 **)(result + 232);
if( *v6 )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
if( (*(_BYTE *)(result + 184) & 7) == 2 )
v8 = &qword_140C4F500;
else
v8 = (unsigned __int64 *)(result + 256);
LockHandle.LockQueue.Lock = v8;
LockHandle.LockQueue.Next = 0i64;
KxAcquireQueuedSpinLock((PIO_WORKITEM)&LockHandle, (PIO_WORKITEM_ROUTINE)v8, (WORK_QUEUE_TYPE)a3, v3);
if( *v6 )
{
MiEmptyPageAccessLog(*v6);
*v6 = 0i64;
}
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
result = CurrentIrql;
__writecr8(CurrentIrql);
}
return result;
}Referenced by:
MiCaptureAndResetWorkingSetAccessBits
MiCleanWorkingSet
MiDeletePartialVad
MiDeleteSessionAddressSpace
MiDeleteVad
MiEmptyAccessLogs