MmQuerySessionWorkingSetInformation

VOID __fastcall MmQuerySessionWorkingSetInformation(_SYSTEM_WORKINGSET_ENTRY *SessionWsEntry, UINT64 *SessionCount){
  int v4; 
  _SYSTEM_WORKINGSET_ENTRY *v5; 
  __int64 *v6; 
  unsigned int *p_WorkingSetPageCount; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  unsigned __int64 v11; 
  unsigned __int64 v12; 
  _KLOCK_QUEUE_HANDLE LockHandle; 

  memset(&LockHandle, 0, sizeof(LockHandle));
  v4 = 0;
  v5 = &SessionWsEntry[2 * *(unsigned int *)SessionCount];
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 522, &LockHandle);
  v6 = (__int64 *)*(&stru_140C4DB30 + 546);
  if( (_UNKNOWN *)*(&stru_140C4DB30 + 546) != (_UNKNOWN *)((char *)&stru_140C4DB30 + 4368) )
  {
    p_WorkingSetPageCount = &SessionWsEntry[1].WorkingSetPageCount;
    do
    {
      if( p_WorkingSetPageCount - 6 != (unsigned int *)v5 )
      {
        *(p_WorkingSetPageCount - 6) = *((_DWORD *)v6 - 30);
        v8 = v6[32];
        *((_QWORD *)p_WorkingSetPageCount + 1) = v8;
        v9 = v6[31];
        *((_QWORD *)p_WorkingSetPageCount - 2) = v9;
        v10 = v6[7];
        *(_QWORD *)p_WorkingSetPageCount = v10;
        v11 = *(v6 - 10);
        *((_QWORD *)p_WorkingSetPageCount - 1) = v11;
        v12 = v11;
        if( v10 < v11 )
          v12 = v10;
        *(_QWORD *)p_WorkingSetPageCount = v12;
        if( v8 >= v9 )
          v8 = v9;
        if( v8 < v11 )
          v11 = v8;
        *((_QWORD *)p_WorkingSetPageCount + 1) = v11;
        p_WorkingSetPageCount += 10;
      }
      v6 = (__int64 *)*v6;
      ++v4;
    }
    while( v6 != (__int64 *)((char *)&stru_140C4DB30 + 4368) );
  }
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
  *(_DWORD *)SessionCount = v4;
}

Referenced by: