MiZeroAllPageFiles
UINT64 __fastcall MiZeroAllPageFiles(){
_ETHREAD *CurrentThread;
__int64 v1;
ULONG v2;
ULONG v3;
__int64 v4;
_KEVENT *v5;
WORK_QUEUE_ITEM *v6;
WORK_QUEUE_ITEM *v7;
PVOID Object[64];
struct _KWAIT_BLOCK WaitBlockArray;
memset((INT64)Object, 0i64);
VfZeroAllPagesRunning = 1;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50ED0, 0i64);
v1 = qword_140C50B60;
v2 = Count;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50ED0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50ED0);
KeAbPostRelease(&qword_140C50ED0);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
if( v1 && v2 )
{
KeWaitForSingleObject(qword_140C50DB8, WrKernel, 0, 0, 0i64);
v3 = v2;
do
{
v4 = v3 - 1;
v5 = (_KEVENT *)&Object[3 * v4 + 16];
KeInitializeEvent(v5, NotificationEvent, 0);
Object[v4] = v5;
if( (*(_BYTE *)(*(&MiSystemPartition + v4 + 868) + 204) & 0x40) != 0
|| (LODWORD(v6) = MiAllocatePool((struct _SLIST_ENTRY *)0x40), (v7 = v6) == 0i64) )
{
KeSetEvent((PRKEVENT)&Object[3 * v4 + 16], 0);
}
else
{
v6[1].List.Flink = (_LIST_ENTRY *)*(&MiSystemPartition + v4 + 868);
v6[1].List.Blink = (_LIST_ENTRY *)v5;
if( v3 == 1 )
{
KeSetEvent((PRKEVENT)&Object[3 * v4 + 16], 0);
MiZeroPageFile(v7);
}
else
{
v6->List.Flink = 0i64;
v6->WorkerRoutine = (void(__fastcall *)(void *))MiZeroPageFile;
v6->Parameter = v6;
ExQueueWorkItem(v6, CriticalWorkQueue);
}
}
--v3;
}
while( (_DWORD)v4 );
if( v2 > 1 )
KeWaitForMultipleObjects((_BYTE *)v2, Object, WaitAll, Executive, 0, 0, 0i64, &WaitBlockArray);
}
VfZeroAllPagesRunning = 0;
return 1i64;
}Referenced by:
MiShutdownSystem