MmGetPageFileInformation
NTSTATUS __stdcall MmGetPageFileInformation(
PVOID SystemInformation,
UINT64 SystemInformationLength,
UINT64 ExInfo,
UINT64 *a4){
unsigned int v5;
unsigned int *v6;
__int64 v7;
__int64 v8;
unsigned int v9;
unsigned int v10;
unsigned int v11;
UINT64 v12;
unsigned int *v13;
unsigned int v14;
unsigned int v15;
unsigned int v16;
unsigned int v17;
unsigned int v18;
unsigned int v19;
unsigned int v20;
unsigned __int64 v21;
unsigned int v24;
unsigned int v25;
__int128 v27;
unsigned int v29;
int v30;
unsigned int *v31;
v30 = (int)a4;
v29 = ExInfo;
v5 = (_DWORD)a4 != 0 ? 40 : 32;
v6 = v31;
*v31 = 0;
LODWORD(v7) = MiPartitionObjectToPartition((PVOID)0xFFFFFFFFFFFFFFFFi64);
v8 = v7;
if( !v7 )
return -1073740640;
v9 = *(_DWORD *)(v7 + 6936);
v25 = v9;
*(_DWORD *)(SystemInformationLength + 4) = 0;
v10 = 0;
v11 = 0;
v12 = SystemInformationLength;
while( v10 < v9 )
{
v13 = *(unsigned int **)(v8 + 8i64 * v10 + 6944);
if( (v13[51] & 0x50) == 0 )
{
v12 = SystemInformationLength + v11;
v14 = v11 + v5;
if( v11 + v5 <= v11 || v14 > v29 )
{
*v6 = v14;
return -1073741820;
}
v15 = *v13;
v16 = v13[6];
v17 = v13[8];
v18 = v13[4];
v19 = v13[2];
while( v16 >= v15 )
;
*(_DWORD *)(v12 + 4) = v15;
*(_DWORD *)(v12 + 8) = v15 - v16 - 2;
*(_DWORD *)(v12 + 12) = v17;
if( v30 )
{
*(_DWORD *)(v12 + 32) = v18;
*(_DWORD *)(v12 + 36) = v19;
}
WORD3(v27) = 0;
v20 = *(unsigned __int16 *)(*(_QWORD *)(v8 + 8i64 * v10 + 6944) + 96i64);
LOWORD(v27) = v20;
*(_DWORD *)((char *)&v27 + 2) = (unsigned __int16)(v20 + 2);
*((_QWORD *)&v27 + 1) = v12 + v5;
*(_OWORD *)(v12 + 16) = v27;
v24 = (*(_DWORD *)((char *)&v27 + 2) + 7) & 0xFFFFFFF8;
v11 = v24 + v14;
if( v24 + v14 > v29 || v11 <= v14 )
{
*v6 = v11;
return -1073741820;
}
v21 = v20;
memmove((UINT8 *)(v12 + v5), *(UINT8 **)(*(_QWORD *)(v8 + 8i64 * v10 + 6944) + 104i64), v20);
*(_WORD *)(*((_QWORD *)&v27 + 1) + 2 * (v21 >> 1)) = 0;
*(_DWORD *)v12 = v5 + v24;
v6 = v31;
}
++v10;
v9 = v25;
}
*(_DWORD *)v12 = 0;
*v6 = v11;
return 0;
}Referenced by:
ExpQuerySystemInformation