MiFillSessionWorkingSetEntry
VOID __stdcall MiFillSessionWorkingSetEntry(_SYSTEM_WORKINGSET_ENTRY *SessionWsEntry, _MM_SESSION_SPACE *Session){
unsigned __int64 v2;
unsigned __int64 v3;
unsigned __int64 v4;
unsigned __int64 v5;
SessionWsEntry->UniqueProcessId = *((_DWORD *)Session + 2);
v2 = *((_QWORD *)Session + 48);
*(_QWORD *)&SessionWsEntry[1].PagedPoolPageCount = v2;
v3 = *((_QWORD *)Session + 47);
*(_QWORD *)&SessionWsEntry->CommitPageCount = v3;
v4 = *((_QWORD *)Session + 23);
*(_QWORD *)&SessionWsEntry[1].WorkingSetPageCount = v4;
v5 = *((_QWORD *)Session + 6);
*(_QWORD *)&SessionWsEntry->PrivateWorkingSetPageCount = v5;
if( v4 >= v5 )
v4 = v5;
*(_QWORD *)&SessionWsEntry[1].WorkingSetPageCount = v4;
if( v2 >= v3 )
v2 = v3;
if( v2 < v5 )
v5 = v2;
*(_QWORD *)&SessionWsEntry[1].PagedPoolPageCount = v5;
}Referenced by:
PfpPrivSourceEnum