MiZeroPageFile

VOID __stdcall MiZeroPageFile(PVOID Context){
  __int64 *v2; 
  bool v3; 
  unsigned int v4; 
  int v5; 
  KIRQL v6; 
  __int64 v7; 
  KIRQL v8; 
  unsigned int v9; 
  unsigned __int64 v10; 
  unsigned int v11; 
  FILE_OBJECT *v12; 
  unsigned int v13; 
  LARGE_INTEGER LargeNumberOfBytes; 
  LARGE_INTEGER FileOffset; 
  PRKEVENT Event; 
  struct _MDL MemoryDescriptorList; 
  _QWORD v18[16]; 
  FileOffset.QuadPart = 0i64;
  LargeNumberOfBytes.QuadPart = 0i64;
  memset((INT64)&MemoryDescriptorList, 0i64);
  v2 = (__int64 *)*((_QWORD *)Context + 4);
  Event = (PRKEVENT)*((_QWORD *)Context + 5);
  ExFreePoolWithTag(Context, 0);
  v3 = (*((_WORD *)v2 + 102) & 0x800) == 0;
  MemoryDescriptorList.StartVa = 0i64;
  *(_QWORD *)&MemoryDescriptorList.ByteCount = 0i64;
  if( v3 )
  {
    *(_DWORD *)&MemoryDescriptorList.Size = 48;
  }
  else
  {
    *(_DWORD *)&MemoryDescriptorList.Size = 131120;
    memset64(v18, qword_140C4EAC0, 0x10ui64);
  }
  v13 = 0;
  v4 = 0;
  v5 = 0;
  v6 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v2 + 58);
  v7 = *v2;
  v8 = v6;
  v9 = 1;
  if( (unsigned __int64)*v2 > 1 )
  {
    v10 = 1i64;
    do
    {
      if( _bittest64(*(const signed __int64 **)(v2[14] + 16), v10) )
      {
        if( v4 )
          v5 = 1;
      }
      else
      {
        v11 = v9;
        if( v4 )
          v11 = v13;
        ++v4;
        v13 = v11;
        if( v4 == 16 || v10 == v7 - 1 )
          v5 = 1;
      }
      if( v5 )
      {
        ExReleaseSpinLockExclusiveFromDpcLevel(v2 + 29);
        __writecr8(v8);
        if( (*((_WORD *)v2 + 102) & 0x800) != 0 )
        {
          MemoryDescriptorList.ByteCount = v4 << 12;
        }
        else
        {
          v12 = (FILE_OBJECT *)v2[7];
          FileOffset.QuadPart = (unsigned __int64)v13 << 12;
          LargeNumberOfBytes.QuadPart = (unsigned __int64)v4 << 12;
          MmZeroPageWrite(v12, &FileOffset, &LargeNumberOfBytes, 0i64);
        }
        v5 = 0;
        v8 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v2 + 58);
        v4 = 0;
      }
      v7 = *v2;
      v10 = ++v9;
    }
    while( v9 < (unsigned __int64)*v2 );
  }
  ExReleaseSpinLockExclusiveFromDpcLevel(v2 + 29);
  __writecr8(v8);
  if( (*((_WORD *)v2 + 102) & 0x800) != 0 && (MemoryDescriptorList.MdlFlags & 1) != 0 )
    MmUnmapLockedPages(MemoryDescriptorList.MappedSystemVa, &MemoryDescriptorList);
  KeSetEvent(Event, 0);
}

Referenced by: