MmProcessWorkingSetControl

NTSTATUS __stdcall MmProcessWorkingSetControl(
        VOID *ProcessHandle,
        VOID *ProcessInformation,
        UINT64 ProcessInformationLength,
        _KPROCESSOR_MODE PreviousMode){
  CHAR v4; 
  unsigned int v6; 
  NTSTATUS result; 
  char *v8; 
  UINT64 v9; 
  NTSTATUS v10; 
  NTSTATUS v11; 
  NTSTATUS v12; 
  UINT8 v13; 
  UINT64 Tag; 
  __int64 v15; 
  unsigned int ControlFlags; 
  PVOID Process[2]; 
  _KAPC_STATE ApcState; 

  v4 = PreviousMode;
  Process[1] = ProcessHandle;
  v6 = 0;
  Process[0] = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  if( (unsigned int)ProcessInformationLength < 0xC )
    return -1073741820;
  v15 = *(_QWORD *)ProcessInformation;
  ControlFlags = *((_DWORD *)ProcessInformation + 2);
  if( (unsigned int)*(_QWORD *)ProcessInformation != 3 )
    return -1073741735;
  if( HIDWORD(v15) >= 2 )
    return -1073741811;
  if( !HIDWORD(v15) && !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
    return -1073741727;
  LODWORD(Tag) = 1935109453;
  result = ObpReferenceObjectByHandleWithTag(
             ProcessHandle,
             0x2000ui64,
             (_OBJECT_TYPE *)PsProcessType,
             v4,
             Tag,
             Process,
             0i64,
             0i64);
  if( result >= 0 )
  {
    v8 = (char *)Process[0];
    if( KeGetCurrentThread()->ApcState.Process == Process[0] )
    {
      LODWORD(Process[0]) = 0;
    }
    else
    {
      LODWORD(Process[0]) = 1;
      KiStackAttachProcess(v8, 0i64, &ApcState);
    }
    if( HIDWORD(v15) )
    {
      if( (ControlFlags & 0xFFFFFFC0) == 0 )
      {
        if( ((ControlFlags & 0x20) == 0 || !v4)
          && (ControlFlags & 1) != ((ControlFlags & 2) == 0)
          && ((ControlFlags & 8) == 0 || (ControlFlags & 2) != 0)
          && ((ControlFlags & 0x10) == 0 || (ControlFlags & 8) != 0) )
        {
          MiLogWsEmptyControl((_MMSUPPORT_INSTANCE *)(v8 + 1664), ControlFlags);
          if( (ControlFlags & 1) != 0 )
          {
            if( (ControlFlags & 8) != 0 )
              SmStoreCompressionStart();
            MiEmptyWorkingSetPrivatePagesByVa((_MMSUPPORT_INSTANCE *)(v8 + 1664));
            v11 = v10;
            if( (ControlFlags & 8) != 0 )
            {
              LOBYTE(v6) = (ControlFlags & 0x10) != 0;
              SmStoreCompressionStop(v6);
            }
            goto LABEL_20;
          }
          v13 = ((ControlFlags & 0x20) != 0 ? 4 : 0) | 1;
          if( (ControlFlags & 4) == 0 )
            v13 = (ControlFlags & 0x20) != 0 ? 4 : 0;
          v12 = MiEmptyWorkingSet((_MMSUPPORT_INSTANCE *)(v8 + 1664), v13, v9);
          goto LABEL_40;
        }
        v11 = -1073741637;
LABEL_20:
        if( LODWORD(Process[0]) == 1 )
          KiUnstackDetachProcess(&ApcState, 0i64);
        ObfDereferenceObjectWithTag(v8, 0x73576D4Dui64);
        return v11;
      }
    }
    else if( (ControlFlags & 0xFFFFFFFE) == 0 )
    {
      v12 = PsSwapProcessWorkingSet(v8, (ControlFlags & 1) == 0);
LABEL_40:
      v11 = v12;
      goto LABEL_20;
    }
    v11 = -1073741811;
    goto LABEL_20;
  }
  return result;
}

Referenced by: