MiGetWorkingSetInfoEx

NTSTATUS __stdcall MiGetWorkingSetInfoEx(
        _MMSUPPORT_INSTANCE *Vm,
        VOID *OutBuffer,
        UINT64 Length,
        UINT64 NeedWorkingSetBlockInfo){
  int v5; 
  NTSTATUS v8; 
  _EPROCESS *v9; 
  int v10; 
  int v11; 
  UINT64 v13; 
  char v14; 
  unsigned __int64 WorkingSetLeafSize; 
  unsigned __int64 v16; 
  UINT64 v17; 
  UINT64 v18; 
  __int128 v19; 
  __int128 v20; 
  _EPROCESS *v21; 
  INT64 v22[22]; 
  _KAPC_STATE ApcState; 

  v5 = (int)OutBuffer;
  v21 = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v19 = 0i64;
  v20 = 0i64;
  memset(v22, 0i64, sizeof(v22));
  v8 = 0;
  v9 = 0i64;
  v10 = 0;
  v11 = 1;
  if( v5 < 0 )
  {
    if( (v5 & 0x40000000) != 0 )
      v11 = 3;
    LODWORD(v19) = v11;
  }
  if( (Vm->Flags._bf_0 & 7) == 0 )
  {
    v9 = (_EPROCESS *)&Vm[-9].AgeDistribution[3];
    if( &Vm[-9].AgeDistribution[3] == (unsigned __int64 *)*(_MMSUPPORT_INSTANCE **)&PsIdleProcess )
    {
      if( v5 >= 0 )
        *(_QWORD *)(Length + 8) = 0i64;
      else
        *(_QWORD *)Length = 0i64;
      return 0;
    }
    if( KeGetCurrentThread()->ApcState.Process != v9 )
    {
      KiStackAttachProcess(&Vm[-9].AgeDistribution[3], 0i64, &ApcState);
      v10 = 1;
    }
  }
  v22[5] = -1i64;
  v22[19] = (INT64)MiQueryLeafPte;
  LOWORD(v22[0]) = -32762;
  v22[21] = (INT64)&v19;
  MiLockWorkingSetShared();
  BYTE6(v22[0]) = v14;
  if( !v9 || (v9->Flags & 0x20) == 0 )
  {
    WorkingSetLeafSize = Vm->WorkingSetLeafSize;
    v16 = WorkingSetLeafSize;
    if( v5 >= 0 )
    {
      v16 = WorkingSetLeafSize - Vm->WorkingSetLeafPrivateSize;
      if( !v16 )
        goto LABEL_31;
      if( NeedWorkingSetBlockInfo < 0x30 )
      {
LABEL_28:
        v8 = -1073741820;
        if( v5 < 0 )
        {
LABEL_29:
          *(_QWORD *)Length = WorkingSetLeafSize;
          goto LABEL_33;
        }
        WorkingSetLeafSize -= Vm->WorkingSetLeafPrivateSize;
LABEL_32:
        *(_QWORD *)(Length + 8) = WorkingSetLeafSize;
        goto LABEL_33;
      }
      v13 = 16i64;
      v17 = (NeedWorkingSetBlockInfo - 48) >> 5;
    }
    else
    {
      if( !WorkingSetLeafSize )
        goto LABEL_31;
      v13 = 16i64;
      if( NeedWorkingSetBlockInfo < 0x10 )
        goto LABEL_28;
      v13 = 8i64;
      v17 = (NeedWorkingSetBlockInfo - 16) >> 3;
    }
    v18 = v17 + 1;
    if( v16 <= v18 )
    {
      if( (Vm->Flags._bf_0 & 7) == 2 )
        LOWORD(v22[0]) |= 1u;
      *((_QWORD *)&v20 + 1) = v18;
      v22[3] = (INT64)Vm;
      *((_QWORD *)&v19 + 1) = v13 + Length;
      v21 = v9;
      if( MiWalkPageTables((INT64)v22) == 4 )
      {
        WorkingSetLeafSize = Vm->WorkingSetLeafSize;
        goto LABEL_28;
      }
LABEL_31:
      WorkingSetLeafSize = v20;
      if( v5 < 0 )
        goto LABEL_29;
      goto LABEL_32;
    }
    goto LABEL_28;
  }
  v8 = -1073741558;
LABEL_33:
  LOBYTE(v13) = BYTE6(v22[0]);
  MiUnlockWorkingSetShared(Vm, v13);
  if( v10 == 1 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  return v8;
}

Referenced by: