MiGetWorkingSetInfoEx

INT64 __fastcall MiGetWorkingSetInfoEx(INT64 a1, INT64 a2, UINT64 *a3, UINT64 a4){
  int v5; 
  unsigned int v8; 
  INT64 v9; 
  int v10; 
  int v11; 
  UINT64 v13; 
  UINT64 v14; 
  __int64 v15; 
  UINT64 v16; 
  UINT64 v17; 
  __int128 v18; 
  __int128 v19; 
  INT64 v20; 
  _WORD result[3]; 
  UINT8 result_6; 
  INT64 v23; 
  __int64 v24; 
  __int64(__fastcall *v25)(__int64, __int64, int); 
  __int128 *v26; 
  _KAPC_STATE ApcState; 
  v5 = a2;
  v20 = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v18 = 0i64;
  v19 = 0i64;
  memset((INT64)result, 0i64);
  v8 = 0;
  v9 = 0i64;
  v10 = 0;
  v11 = 1;
  if( v5 < 0 )
  {
    if( (v5 & 0x40000000) != 0 )
      v11 = 3;
    LODWORD(v18) = v11;
  }
  if( (*(_BYTE *)(a1 + 184) & 7) == 0 )
  {
    v9 = a1 - 1664;
    if( (PVOID)(a1 - 1664) == PsIdleProcess )
    {
      if( v5 >= 0 )
        a3[1] = 0i64;
      else
        *a3 = 0i64;
      return 0i64;
    }
    if( *((_QWORD *)KeGetCurrentThread() + 23) != v9 )
    {
      KiStackAttachProcess((_KPROCESS *)(a1 - 1664), 0i64, &ApcState);
      v10 = 1;
    }
  }
  v24 = -1i64;
  v25 = MiQueryLeafPte;
  result[0] = -32762;
  v26 = &v18;
  result_6 = MiLockWorkingSetShared(a1);
  if( !v9 || (*(_DWORD *)(v9 + 1124) & 0x20) == 0 )
  {
    v13 = *(_QWORD *)(a1 + 120);
    v14 = v13;
    if( v5 >= 0 )
    {
      v14 = v13 - *(_QWORD *)(a1 + 128);
      if( !v14 )
        goto LABEL_31;
      if( a4 < 0x30 )
      {
LABEL_28:
        v8 = -1073741820;
        if( v5 < 0 )
        {
LABEL_29:
          *a3 = v13;
          goto LABEL_33;
        }
        v13 -= *(_QWORD *)(a1 + 128);
LABEL_32:
        a3[1] = v13;
        goto LABEL_33;
      }
      v15 = 2i64;
      v16 = (a4 - 48) >> 5;
    }
    else
    {
      if( !v13 )
        goto LABEL_31;
      if( a4 < 0x10 )
        goto LABEL_28;
      v15 = 1i64;
      v16 = (a4 - 16) >> 3;
    }
    v17 = v16 + 1;
    if( v14 <= v17 )
    {
      if( (*(_BYTE *)(a1 + 184) & 7) == 2 )
        result[0] |= 1u;
      *((_QWORD *)&v19 + 1) = v17;
      v23 = a1;
      *((_QWORD *)&v18 + 1) = &a3[v15];
      v20 = v9;
      if( (unsigned int)MiWalkPageTables((INT64)result) == 4 )
      {
        v13 = *(_QWORD *)(a1 + 120);
        goto LABEL_28;
      }
LABEL_31:
      v13 = v19;
      if( v5 < 0 )
        goto LABEL_29;
      goto LABEL_32;
    }
    goto LABEL_28;
  }
  v8 = -1073741558;
LABEL_33:
  MiUnlockWorkingSetShared(a1, result_6);
  if( v10 == 1 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  return v8;
}

Referenced by: