MiLockDownWorkingSet

void __fastcall MiLockDownWorkingSet(ULONG_PTR a1, int a2){
  INT64 v3; 
  INT64 *SharedVm; 
  KIRQL v5; 
  UINT8 v6; 
  _MMPTE *PxeSelfRef; 
  unsigned __int64 v8; 
  char *v9; 
  UINT64 SpinCount; 
  _KAPC_STATE ApcState; 
  v3 = a1 + 1664;
  memset(&ApcState, 0, sizeof(ApcState));
  KiStackAttachProcess((_KPROCESS *)a1, 0i64, &ApcState);
  SharedVm = MiGetSharedVm(v3);
  v5 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
  *((_DWORD *)SharedVm + 1) = 0;
  v6 = v5;
  PxeSelfRef = MmGetPxeSelfRef();
  v8 = *(_QWORD *)PxeSelfRef;
  MiPteInShadowRange((UINT64)PxeSelfRef);
  v9 = (char *)MmGetPfnDb() + 48 * ((v8 >> 12) & 0xFFFFFFFFFi64);
  LODWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)v9 + 6, 0x3Fui64) )
  {
    do
      KeYieldProcessorEx(&SpinCount);
    while( *((__int64 *)v9 + 3) < 0 );
  }
  if( a2 == 1 )
    MiAddLockedPageCharge((INT64)v9, 1);
  else
    MiRemoveLockedPageChargeAndDecRef((_MMPFN *)v9);
  _InterlockedAnd64((volatile signed __int64 *)v9 + 3, 0x7FFFFFFFFFFFFFFFui64);
  MiUnlockWorkingSetExclusive(v3, v6);
  KiUnstackDetachProcess(&ApcState, 0i64);
}

Referenced by: