MiCleanWorkingSet

UINT64 __stdcall MiCleanWorkingSet(_EPROCESS *Process){
  char *v1; 
  INT64 *SharedVm; 
  KIRQL v4; 
  UINT8 v5; 
  INT64 v6; 
  UINT8 *v7; 
  __int64 v8; 
  v1 = (char *)Process + 1664;
  SharedVm = MiGetSharedVm((INT64)Process + 1664);
  v4 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
  *((_DWORD *)SharedVm + 1) = 0;
  v5 = v4;
  LOBYTE(v6) = v1[187] | 1;
  v1[187] = v6;
  --*((_QWORD *)Process + 159);
  MiDrainSystemAccessLog((INT64)v1, v6, v7);
  v8 = *((_QWORD *)v1 + 14);
  MiUnlockWorkingSetExclusive((INT64)v1, v5);
  return v8 - 4;
}

Referenced by: