MmInSwapWorkingSet

NTSTATUS __stdcall MmInSwapWorkingSet(_EPROCESS *Process){
  _MMSUPPORT_FULL *p_Vm; 
  VOID **v3; 
  __int64 v4; 
  unsigned __int64 v5; 
  char *WorkingSetSwapSupport; 
  _MMSUPPORT_INSTANCE *v7; 
  __int64 *v8; 
  char v9; 
  __int64 v10; 
  _MMSUPPORT_INSTANCE *v11; 
  NTSTATUS v12; 
  __int128 EventParameters[2]; 
  __int64 v15; 

  p_Vm = &Process->Vm;
  memset(EventParameters, 0, sizeof(EventParameters));
  v3 = 0i64;
  v15 = 0i64;
  EtwTraceWorkingSetSwap(Process, 3ui64, EventParameters);
  v4 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * p_Vm->Instance.PartitionId);
  v5 = (unsigned __int8)ExAcquireSpinLockExclusive((INT64 *)(v4 + 1136));
  WorkingSetSwapSupport = (char *)MiGetWorkingSetSwapSupport(&p_Vm->Instance);
  v8 = (__int64 *)WorkingSetSwapSupport;
  if( WorkingSetSwapSupport )
  {
    if( WorkingSetSwapSupport == (char *)1 )
    {
      v12 = -1073740682;
    }
    else if( WorkingSetSwapSupport == (char *)2 )
    {
      v12 = -1073741558;
    }
    else
    {
      MiGetSharedVm(v7)->WsSwapSupport = (void *)1;
      ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v4 + 1136));
      __writecr8(v5);
      if( *(_DWORD *)(v4 + 1160) )
      {
        MiInSwapStore(Process);
        SmStoreSetProcessVaRanges(0i64, 0i64);
      }
      v9 = 0;
      if( Process->VmContext && *(_QWORD *)(*v8 + 16) )
      {
        v3 = (VOID **)MiReAllocateWorkingSetSwapSupport((_MI_WS_SWAP_SUPPORT *)*v8);
        if( v3 && (*(_BYTE *)(*v8 + 32) & 1) == 0 )
          v9 = 1;
        if( VmCheckLargePageInswap((INT64)Process) )
          v9 |= 4u;
      }
      MiProcessWsInSwapSupport(*v8, v9);
      if( v3 )
        VmPrefetchVirtualAddresses(*v3);
      v10 = v8[7];
      if( v10 )
        MiProcessWsInSwapSupport(v10, 1);
      if( v8[1] )
      {
        v8[5] = (__int64)v8;
        v8[4] = (__int64)MiInSwapSharedWorkingSetWorker;
        v8[2] = 0i64;
        ObfReferenceObjectWithTag(Process, 0x73576D4Dui64);
        v8[6] = (__int64)Process;
        ExQueueWorkItemToPartition(v8 + 2);
      }
      else
      {
        MiFreeWorkingSetSwapContext((_MI_PARTITION *)v4, v8);
      }
      LOBYTE(v5) = ExAcquireSpinLockExclusive((INT64 *)(v4 + 1136));
      if( MiGetWorkingSetSwapSupport(&p_Vm->Instance) == (VOID *)1 )
        MiGetSharedVm(v11)->WsSwapSupport = 0i64;
      v12 = 0;
    }
  }
  else
  {
    v12 = -1073741275;
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v4 + 1136));
  __writecr8((unsigned __int8)v5);
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  MiContractWsSwapPageFile((_MI_PARTITION *)v4);
  LODWORD(v15) = v12;
  EtwTraceWorkingSetSwap(Process, 1ui64, EventParameters);
  return v12;
}

Referenced by: