MiCombineWorkingSet

NTSTATUS __stdcall MiCombineWorkingSet(_MI_COMBINE_CONTROL_BLOCK *CombineControlBlock){
  _MMSUPPORT_INSTANCE *v2; 
  NTSTATUS v3; 
  _MI_COMBINE_CONTROL_BLOCK v4; 
  void *v5; 
  _EPROCESS *v6; 
  NTSTATUS v7; 
  UINT64 v8; 
  char v9; 
  unsigned __int64 WorkingSetPrivateSize; 
  unsigned __int64 v11; 
  VOID *Pool; 
  __int128 v14; 
  __int128 v15; 
  VOID *v16; 
  INT64 v17[22]; 

  v16 = 0i64;
  v14 = 0i64;
  v15 = 0i64;
  memset(v17, 0i64, sizeof(v17));
  v2 = (_MMSUPPORT_INSTANCE *)*((_QWORD *)CombineControlBlock + 4);
  v3 = 0;
  v4 = CombineControlBlock[15];
  v5 = 0i64;
  v6 = (_EPROCESS *)&v2[-9].AgeDistribution[3];
  v7 = 3;
  if( (v2->Flags._bf_0 & 7) != 0 )
    v6 = 0i64;
  MiLockWorkingSetShared();
  BYTE6(v17[0]) = v9;
  if( !v6 || (v6->Flags & 0xC00) >= 0xC00 && !v2->ExitOutswapGate && !MiIsStoreProcess(v6) )
  {
    WorkingSetPrivateSize = v2->WorkingSetPrivateSize;
    if( WorkingSetPrivateSize )
    {
      v11 = (40 * WorkingSetPrivateSize + 4095) & 0xFFFFFFFFFFFFF000ui64;
      while( 1 )
      {
        Pool = MiAllocatePool(64i64, v11, 0x6D75534Dui64);
        v5 = Pool;
        if( Pool )
          break;
        v11 >>= 1;
        if( v11 < 0x10000 )
          goto LABEL_13;
      }
      v17[5] = -1i64;
      *((_QWORD *)&v15 + 1) = CombineControlBlock;
      v16 = Pool;
      v17[21] = (INT64)&v14;
      v17[19] = (INT64)MiCombinePte;
      v17[20] = (INT64)MiCombineWorkingSetTail;
      *(_QWORD *)&v15 = v11 / 0x28;
      LODWORD(v14) = v4;
      v17[3] = (INT64)v2;
      LOWORD(v17[0]) = 6;
      BYTE5(v17[0]) = 7;
      v7 = MiWalkPageTables((INT64)v17);
    }
  }
LABEL_13:
  LOBYTE(v8) = BYTE6(v17[0]);
  MiUnlockWorkingSetShared(v2, v8);
  MiFreeCombineMdls((INT64)CombineControlBlock);
  if( v5 )
    ExFreePoolWithTag(v5, 0);
  if( v7 == 4 )
    return -1073741248;
  return v3;
}

Referenced by: