MmEnforceWorkingSetLimit

NTSTATUS __stdcall MmEnforceWorkingSetLimit(_EPROCESS *Process, UINT64 Flags){
  _MMSUPPORT_FULL *p_Vm; 
  int v3; 
  NTSTATUS v4; 
  char v5; 
  char v6; 
  _MMSUPPORT_SHARED *SharedVm; 
  UINT8 v8; 
  UINT8 v9; 
  char bf_0; 
  _BOOL8 v11; 
  char v12; 
  char v13; 
  _MMSUPPORT_FLAGS v15; 
  _KLOCK_QUEUE_HANDLE LockQueue; 
  _KAPC_STATE ApcState; 

  *(_QWORD *)&LockQueue.OldIrql = 0i64;
  p_Vm = &Process->Vm;
  v3 = 0;
  v4 = 0;
  v5 = Flags & 0xF7;
  ApcState.ApcListHead[0] = 0i64;
  if( (Flags & 4) == 0 )
    v5 = Flags;
  memset(&ApcState.ApcListHead[1], 0, 32);
  v6 = (Flags & 4) != 0 ? 0x80 : 0;
  if( (v5 & 1) != 0 )
  {
    v5 &= ~2u;
    v6 |= 0x40u;
  }
  if( KeGetCurrentThread()->ApcState.Process != Process )
  {
    v3 = 1;
    KiStackAttachProcess(Process, 0i64, &ApcState);
  }
  SharedVm = MiGetSharedVm(&p_Vm->Instance);
  v8 = ExAcquireSpinLockExclusive((INT64 *)&SharedVm->WorkingSetLock);
  SharedVm->GoodCitizenWaiting = 0;
  LockQueue.LockQueue.Next = 0i64;
  LockQueue.LockQueue.Lock = (unsigned __int64 *volatile)((char *)&stru_140C4DB30 + 4176);
  v9 = v8;
  KxAcquireQueuedSpinLock(&LockQueue.LockQueue, (UINT64 *)&stru_140C4DB30 + 522);
  v15 = p_Vm->Instance.Flags;
  bf_0 = v15.$9F51E323906620A7CE080F79FB124AD0::$3F85127412E45D453B47E0230FB8DC78::_bf_0;
  if( (v5 & 8) != 0 )
  {
    bf_0 = v15.$9F51E323906620A7CE080F79FB124AD0::$3F85127412E45D453B47E0230FB8DC78::_bf_0 & 0x7F;
    v15.$9F51E323906620A7CE080F79FB124AD0::$3F85127412E45D453B47E0230FB8DC78::_bf_0 &= ~0x80u;
  }
  v11 = (v5 & 8) != 0;
  if( (v5 & 2) != 0 )
  {
    bf_0 &= ~0x40u;
    LODWORD(v11) = 1;
    v15.$9F51E323906620A7CE080F79FB124AD0::$3F85127412E45D453B47E0230FB8DC78::_bf_0 = bf_0;
  }
  v12 = v6 | 0x80;
  if( bf_0 >= 0 )
    v12 = v6;
  v13 = v12 | 0x40;
  if( (bf_0 & 0x40) == 0 )
    v13 = v12;
  if( (v13 & 0x80) != 0
    && (v13 & 0x40) != 0
    && p_Vm->Instance.MinimumWorkingSetSize + 6 >= p_Vm->Instance.MaximumWorkingSetSize )
  {
    v5 = -6;
    v4 = -1073741748;
  }
  if( (v5 & 4) != 0 )
  {
    bf_0 |= 0x80u;
    LODWORD(v11) = 1;
    v15.$9F51E323906620A7CE080F79FB124AD0::$3F85127412E45D453B47E0230FB8DC78::_bf_0 = bf_0;
  }
  if( (v5 & 1) != 0 )
  {
    LODWORD(v11) = 1;
    v15.$9F51E323906620A7CE080F79FB124AD0::$3F85127412E45D453B47E0230FB8DC78::_bf_0 = bf_0 | 0x40;
  }
  if( v11 )
    p_Vm->Instance.Flags.u1 = v15.u1;
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockQueue);
  MiUnlockWorkingSetExclusive(&p_Vm->Instance, v9);
  if( v3 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  return v4;
}

Referenced by: