MiContractPagingFiles

VOID __stdcall MiContractPagingFiles(_MI_PARTITION *Partition){
  unsigned int v2; 
  unsigned int v3; 
  char *v4; 
  _QWORD *v5; 
  unsigned __int64 v6; 
  if( (unsigned int)MiOkToShrinkPageFiles(*((_QWORD *)Partition + 933), *((_QWORD *)Partition + 949)) )
  {
    v2 = *((_DWORD *)Partition + 1734);
    v3 = 0;
    if( v2 )
    {
      v4 = (char *)Partition + 6944;
      do
      {
        v5 = *(_QWORD **)v4;
        if( (*(_WORD *)(*(_QWORD *)v4 + 204i64) & 0x50) == 0 && *v5 != v5[2] && v5[3] > 0x4000ui64 )
          break;
        ++v3;
        v4 += 8;
      }
      while( v3 < v2 );
    }
    if( v3 != v2 )
    {
      v6 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)Partition + 336);
      if( *((_QWORD *)Partition + 70) == -1i64 )
      {
        ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)Partition + 168);
        __writecr8(v6);
      }
      else
      {
        *((_QWORD *)Partition + 66) = 0i64;
        *((_BYTE *)Partition + 607) |= 0x10u;
        *((_QWORD *)Partition + 69) = Partition;
        *((_QWORD *)Partition + 70) = -1i64;
        MiQueuePageFileExtension((_MMPAGE_FILE_EXPANSION *)((char *)Partition + 528), 0i64);
      }
    }
  }
}

Referenced by:

MmDeleteProcessAddressSpace