PspQueryWorkingSetWatch

NTSTATUS __stdcall PspQueryWorkingSetWatch(
        VOID *ProcessHandle,
        PROCESSINFOCLASS ProcessInformationClass,
        VOID *ProcessInformation,
        UINT64 ProcessInformationLength,
        UINT64 *ReturnLength,
        INT8 PreviousMode){
  NTSTATUS result; 
  int v8; 
  CHAR v9; 
  VOID *v10; 
  __int64 v11; 
  NTSTATUS v12; 
  _ETHREAD *CurrentThread; 
  __int64 v14; 
  signed __int32 v15; 
  unsigned int v16; 
  unsigned int v17; 
  __int64 i; 
  char *v19; 
  __int64 j; 
  UINT64 Tag; 
  PVOID Object; 
  char *v23; 
  _ETHREAD *v24; 
  __int64 v25; 
  unsigned int v28; 

  v28 = ProcessInformationLength;
  Object = 0i64;
  if( ProcessInformationClass == ProcessWorkingSetWatchEx )
  {
    if( (ProcessInformationLength & 0x1F) != 0 )
      return -1073741820;
    v8 = 32;
  }
  else
  {
    v8 = 16;
  }
  if( (unsigned int)ExIsRestrictedCaller(PreviousMode) )
    return -1073741790;
  LODWORD(Tag) = 2035381072;
  result = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             0x400ui64,
             (_OBJECT_TYPE *)PsProcessType,
             PreviousMode,
             Tag,
             &Object,
             0i64);
  if( result >= 0 )
  {
    v10 = Object;
    v11 = *((_QWORD *)Object + 166);
    v25 = v11;
    if( !v11 )
    {
      v12 = -1073741823;
LABEL_17:
      ObfDereferenceObjectWithTag(v10, 0x79517350ui64);
      return v12;
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v24 = CurrentThread;
    v12 = 0;
    v14 = 0i64;
    --CurrentThread->Tcb.KernelApcDisable;
    _m_prefetchw((const void *)v11);
    v15 = _InterlockedOr((volatile signed __int32 *)v11, 1u);
    if( (v15 & 1) != 0 )
    {
      v12 = -2147483622;
    }
    else
    {
      v16 = (unsigned __int16)v15 >> 1;
      if( (unsigned __int16)v15 >> 1 )
      {
        if( (v15 & 0x7FFF0000) != 0 )
          KeWaitForGate((_KGATE *)(v11 + 16), Executive, v9);
        v17 = v8 * (v16 + 1);
        if( v28 >= v17 )
        {
          _m_prefetchw((const void *)(v11 + 8));
          v14 = *(_QWORD *)(v11 + 8);
          if( ProcessInformationClass == ProcessWorkingSetWatchEx )
          {
            for( i = 0i64; ; i = (unsigned int)(i + 1) )
            {
              v19 = (char *)ProcessInformation + 32 * (unsigned int)i;
              if( (unsigned int)i >= v16 )
                break;
              *(_OWORD *)v19 = *(_OWORD *)(v11 + 24 * i + 40);
              *((_OWORD *)v19 + 1) = *(unsigned __int64 *)(v11 + 24 * i + 56);
            }
            v23 = (char *)ProcessInformation + 32 * (unsigned int)i;
            *((_QWORD *)v19 + 2) = 0i64;
            *((_QWORD *)v19 + 3) = 0i64;
          }
          else
          {
            v19 = (char *)ProcessInformation;
            v23 = (char *)ProcessInformation;
            for( j = 0i64; (unsigned int)j < v16; j = (unsigned int)(j + 1) )
            {
              *(_OWORD *)v19 = *(_OWORD *)(v11 + 24 * j + 40);
              v19 += 16;
              v23 = v19;
            }
          }
          *(_QWORD *)v19 = 0i64;
          *((_QWORD *)v19 + 1) = v14;
          if( ReturnLength )
            *(_DWORD *)ReturnLength = v17;
        }
        else
        {
          v12 = -1073741789;
          if( ReturnLength )
            *(_DWORD *)ReturnLength = v17;
        }
        if( v12 >= 0 )
        {
          _InterlockedExchangeAdd64((volatile signed __int64 *)(v11 + 8), -v14);
          *(_DWORD *)v11 = 0;
          goto LABEL_16;
        }
      }
      else
      {
        v12 = -2147483622;
      }
      _interlockedbittestandreset((volatile signed __int32 *)v11, 0);
    }
LABEL_16:
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    v10 = Object;
    goto LABEL_17;
  }
  return result;
}

Referenced by: