MiCleanCfg
VOID __stdcall MiCleanCfg(){
_ETHREAD *CurrentThread;
__int64 v1;
_EX_PUSH_LOCK **p_NextPteToAccessClear;
_EX_PUSH_LOCK *v3;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v1 = 2i64;
p_NextPteToAccessClear = (_EX_PUSH_LOCK **)&CurrentThread->Tcb.ApcState.Process->Vm.Instance.VmWorkingSetList[11].NextPteToAccessClear;
do
{
v3 = *p_NextPteToAccessClear;
if( *p_NextPteToAccessClear )
{
--CurrentThread->Tcb.SpecialApcDisable;
ExAcquirePushLockSharedEx(v3 + 5, 0i64);
CurrentThread->_bf_1 |= 0x40u;
MiUnlockAndDereferenceVadShared(v3);
*p_NextPteToAccessClear = 0i64;
}
p_NextPteToAccessClear += 4;
--v1;
}
while( v1 );
}Referenced by:
MmCleanProcessAddressSpace