MmQueryWorkingSetInformation

NTSTATUS __stdcall MmQueryWorkingSetInformation(
        UINT64 *PeakWorkingSetSize,
        UINT64 *WorkingSetSize,
        UINT64 *PrivateWorkingSetSize,
        UINT64 *MinimumWorkingSetSize,
        UINT64 *MaximumWorkingSetSize,
        UINT64 *HardEnforcementFlags){
  _MMSUPPORT_FULL *p_Vm; 
  char v11; 
  UINT64 v12; 
  char bf_0; 

  *(_DWORD *)HardEnforcementFlags = 0;
  p_Vm = &KeGetCurrentThread()->ApcState.Process->Vm;
  MiLockWorkingSetShared();
  LOBYTE(v12) = v11;
  *PeakWorkingSetSize = p_Vm->Instance.PeakWorkingSetSize << 12;
  *WorkingSetSize = p_Vm->Instance.WorkingSetLeafSize << 12;
  *PrivateWorkingSetSize = p_Vm->Instance.WorkingSetLeafPrivateSize << 12;
  *MinimumWorkingSetSize = p_Vm->Instance.MinimumWorkingSetSize << 12;
  *MaximumWorkingSetSize = p_Vm->Instance.MaximumWorkingSetSize << 12;
  bf_0 = p_Vm->Instance.Flags._bf_0;
  if( bf_0 < 0 )
  {
    *(_DWORD *)HardEnforcementFlags |= 4u;
    bf_0 = p_Vm->Instance.Flags._bf_0;
  }
  if( (bf_0 & 0x40) != 0 )
    *(_DWORD *)HardEnforcementFlags |= 1u;
  MiUnlockWorkingSetShared(&p_Vm->Instance, v12);
  return 0;
}

Referenced by: