VmpPauseResumeNotify

__int64 __fastcall VmpPauseResumeNotify(__int64 a1, int a2){
  _ETHREAD *CurrentThread; 
  int v5; 
  _EX_PUSH_LOCK *v6; 
  unsigned int v7; 
  NTSTATUS v8; 
  int v9; 
  _EPROCESS *v10; 
  int i; 
  int v12; 
  bool v13; 
  int v14; 
  int v15; 
  unsigned int v16; 
  int ProcessInformation; 
  __int64 v19; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = 4;
  --CurrentThread->Tcb.KernelApcDisable;
  v6 = (_EX_PUSH_LOCK *)(a1 + 96);
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(a1 + 96), 0i64);
  v7 = *(_DWORD *)(a1 + 104);
  if( (v7 & 1) != 0 )
  {
    v8 = -1073740682;
    goto LABEL_31;
  }
  v9 = (v7 >> 1) & 3;
  if( a2 )
  {
    if( v9 >= a2 )
    {
      v8 = -1073741811;
      goto LABEL_31;
    }
  }
  else if( !v9 )
  {
    v8 = 1075380276;
    goto LABEL_31;
  }
  *(_DWORD *)(a1 + 104) = v7 | 1;
  if( (_InterlockedExchangeAdd64(&v6->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v6);
  KeAbPostRelease(v6);
  v19 = 0i64;
  ProcessInformation = 3;
  if( a2 )
  {
    for( i = v9 + 1; ; ++i )
    {
      if( i > a2 )
      {
        v5 = a2;
        goto LABEL_28;
      }
      if( i == 1 )
      {
        v10 = (_EPROCESS *)(KeGetCurrentThread()->ApcState.Process->Vm.Instance.WorkingSetLeafPrivateSize << 12 >> 20);
        if( (unsigned __int64)v10 > (unsigned int)VmPauseOutswapSizeCapMB )
          continue;
        v19 = 0i64;
      }
      else
      {
        if( (unsigned int)(i - 2) > 1
          || !MiGetProcessPartition(KeGetCurrentThread()->ApcState.Process, v10)->Store.Registered && i != 3 )
        {
          continue;
        }
        v12 = 3;
        v13 = (*(_DWORD *)(a1 + 88) & 1) == 0;
        v14 = *(_DWORD *)(a1 + 88) & 1;
        LODWORD(v19) = 1;
        if( !v13 )
          v12 = 35;
        HIDWORD(v19) = v12;
        v15 = 32 * v14 + 3;
        if( (unsigned int)SmStoreExistsForProcess(KeGetCurrentThread()->ApcState.Process) )
        {
          HIDWORD(v19) = v15 | 8;
          if( i == 3 )
            HIDWORD(v19) = v15 | 0x18;
        }
      }
      v8 = MmProcessWorkingSetControl((VOID *)0xFFFFFFFFFFFFFFFFi64, &ProcessInformation, 0xCui64, 0);
      if( v8 < 0 )
        goto LABEL_29;
    }
  }
  v19 = 0x100000000i64;
  MmProcessWorkingSetControl((VOID *)0xFFFFFFFFFFFFFFFFi64, &ProcessInformation, 0xCui64, 0);
  v5 = 0;
LABEL_28:
  v8 = 0;
LABEL_29:
  ExAcquirePushLockExclusiveEx(v6, 0i64);
  v16 = *(_DWORD *)(a1 + 104) & 0xFFFFFFFE;
  *(_DWORD *)(a1 + 104) = v16;
  if( v5 != 4 )
    *(_DWORD *)(a1 + 104) = v16 ^ ((unsigned __int8)v16 ^ (unsigned __int8)(2 * v5)) & 6;
LABEL_31:
  if( (_InterlockedExchangeAdd64(&v6->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v6);
  KeAbPostRelease(v6);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return(unsigned int)v8;
}

Referenced by: