MiDeleteCloneZombies
VOID __stdcall MiDeleteCloneZombies(INT64 a1, INT64 a2){
_MMSUPPORT_INSTANCE *v3;
UINT8 v4;
_MMSUPPORT_SHARED *SharedVm;
_RTL_BALANCED_NODE *v6;
_RTL_BALANCED_NODE *v7;
if( *(_WORD *)(*(_QWORD *)(a1 + 1680) + 368i64) )
{
v3 = (_MMSUPPORT_INSTANCE *)(a1 + 1664);
if( (_DWORD)a2 )
{
v4 = 17;
}
else
{
SharedVm = MiGetSharedVm((_MMSUPPORT_INSTANCE *)(a1 + 1664));
v4 = ExAcquireSpinLockExclusive((INT64 *)&SharedVm->WorkingSetLock);
SharedVm->GoodCitizenWaiting = 0;
}
v6 = MiDeleteDeferredCloneDescriptors(a1);
if( v4 != 17 )
MiUnlockWorkingSetExclusive(v3, v4);
if( v6 )
{
do
{
v7 = v6->Children[0];
ExFreePoolWithTag(v6, 0);
v6 = v7;
}
while( v7 );
}
}
}Referenced by:
MiDeleteInsertedCloneVads
MiInsertClone
MmCleanProcessAddressSpace