MiContractPagingFiles
VOID __stdcall MiContractPagingFiles(_MI_PARTITION *Partition){
unsigned int v2;
unsigned int v3;
char *v4;
_QWORD *v5;
unsigned __int64 v6;
if( (unsigned int)MiOkToShrinkPageFiles(*((_QWORD *)Partition + 933), *((_QWORD *)Partition + 949)) )
{
v2 = *((_DWORD *)Partition + 1734);
v3 = 0;
if( v2 )
{
v4 = (char *)Partition + 6944;
do
{
v5 = *(_QWORD **)v4;
if( (*(_WORD *)(*(_QWORD *)v4 + 204i64) & 0x50) == 0 && *v5 != v5[2] && v5[3] > 0x4000ui64 )
break;
++v3;
v4 += 8;
}
while( v3 < v2 );
}
if( v3 != v2 )
{
v6 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)Partition + 336);
if( *((_QWORD *)Partition + 70) == -1i64 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)Partition + 168);
__writecr8(v6);
}
else
{
*((_QWORD *)Partition + 66) = 0i64;
*((_BYTE *)Partition + 607) |= 0x10u;
*((_QWORD *)Partition + 69) = Partition;
*((_QWORD *)Partition + 70) = -1i64;
MiQueuePageFileExtension((_MMPAGE_FILE_EXPANSION *)((char *)Partition + 528), 0i64);
}
}
}
}Referenced by:
MmDeleteProcessAddressSpace