MmQueryProcessWorkingSetSwapPages

NTSTATUS __stdcall MmQueryProcessWorkingSetSwapPages(_EPROCESS *Process, UINT64 *OutSwappedPages){
  _MMSUPPORT_FULL *p_Vm; 
  NTSTATUS v5; 
  __int64 v6; 
  unsigned __int64 v7; 
  VOID *WorkingSetSwapSupport; 

  p_Vm = &Process->Vm;
  if( (unsigned __int64)MiGetWorkingSetSwapSupport(&Process->Vm.Instance) <= 2 )
    return -1073741275;
  v5 = -1073741275;
  v6 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * p_Vm->Instance.PartitionId);
  v7 = (unsigned __int8)ExAcquireSpinLockExclusive((INT64 *)(v6 + 1136));
  WorkingSetSwapSupport = MiGetWorkingSetSwapSupport(&p_Vm->Instance);
  if( (unsigned __int64)WorkingSetSwapSupport > 2 )
  {
    v5 = 0;
    *OutSwappedPages = *(_QWORD *)(*(_QWORD *)WorkingSetSwapSupport + 24i64);
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v6 + 1136));
  __writecr8(v7);
  return v5;
}

Referenced by: