MiReAcquireOutSwappedProcessCommit

NTSTATUS __stdcall MiReAcquireOutSwappedProcessCommit(_EPROCESS *Process){
  INT64 *SharedVm; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v4; 
  INT64 *v5; 
  int v6; 
  unsigned int v7; 
  INT64 *v8; 
  KIRQL v9; 
  _QWORD *v10; 
  INT64 *v11; 
  KIRQL v12; 
  WORK_QUEUE_ITEM *v13; 
  struct _KEVENT *Blink; 
  KeForceAttachProcess(Process);
  SharedVm = MiGetSharedVm((INT64)Process + 1664);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0;
  v5 = SharedVm;
  if( dword_140CFA1D0 != 1 )
  {
    if( (*((_DWORD *)Process + 281) & 8) != 0 )
    {
      v7 = 1;
      v6 = 0;
    }
    else
    {
      v7 = 0;
      v6 = MiChargeCommit(
             *(_MI_PARTITION **)(qword_140C4E388 + 8i64 * *((unsigned __int16 *)Process + 919)),
             SharedVm[1],
             1ui64);
      if( v6 )
        goto LABEL_15;
    }
    MiLogOutswappedProcessCommitReacquire(Process, v5[1], 1ui64, v7);
    _InterlockedOr((volatile signed __int32 *)Process + 543, 0x100u);
    v8 = MiGetSharedVm((INT64)Process + 1664);
    v9 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v8);
    *((_DWORD *)v8 + 1) = 0;
    *((_BYTE *)Process + 1851) |= 0x60u;
    MiUnlockWorkingSetExclusive((INT64)Process + 1664, v9);
    MiBeginProcessClean((__int64)CurrentThread, (__int64)Process);
    KeFreezeProcess((__int64)Process, 0);
    ObfReferenceObjectWithTag(Process, 0x746C6644u);
    v10 = (_QWORD *)v5[4];
    v10[2] = MiReAcquireCommitFailWorker;
    v10[3] = Process;
    *v10 = 0i64;
    goto LABEL_6;
  }
  v6 = 1;
LABEL_15:
  MiLogOutswappedProcessCommitReacquire(Process, v5[1], 0i64, 0i64);
LABEL_6:
  v11 = MiGetSharedVm((INT64)Process + 1664);
  v12 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v11);
  *((_DWORD *)v11 + 1) = 0;
  if( (*((_BYTE *)Process + 1851) & 0x60) == 64 )
    *((_BYTE *)Process + 1851) = *((_BYTE *)Process + 1851) & 0x9F | 0x20;
  v13 = (WORK_QUEUE_ITEM *)v5[4];
  if( v6 )
  {
    v5[1] = 0i64;
    v5[4] = 0i64;
  }
  MiUnlockWorkingSetExclusive((INT64)Process + 1664, v12);
  KeForceDetachProcess(0i64, 0);
  Blink = (struct _KEVENT *)v13[1].List.Blink;
  if( Blink )
    KeSetEvent(Blink, 0);
  if( v6 )
  {
    ExFreePoolWithTag(v13, 0);
  }
  else
  {
    ExQueueWorkItem(v13, CriticalWorkQueue);
    return -1073741523;
  }
  return v4;
}

Referenced by: