MmEnforceWorkingSetLimit

__int64 __fastcall MmEnforceWorkingSetLimit(ULONG_PTR a1, char a2){
  INT64 v2; 
  int v3; 
  unsigned int v4; 
  char v5; 
  char v6; 
  INT64 *SharedVm; 
  KIRQL v8; 
  UINT8 v9; 
  WORK_QUEUE_TYPE v10; 
  PVOID v11; 
  char v12; 
  BOOL v13; 
  char v14; 
  char v15; 
  int v17; 
  struct _IO_WORKITEM LockHandle; 
  memset(&LockHandle.WorkItem.WorkerRoutine, 0, 24);
  v2 = a1 + 1664;
  v3 = 0;
  v4 = 0;
  v5 = a2 & 0xF7;
  if( (a2 & 4) == 0 )
    v5 = a2;
  memset(&LockHandle.IoObject, 0, 32);
  v6 = (a2 & 4) != 0 ? 0x80 : 0;
  if( (v5 & 1) != 0 )
  {
    v5 &= ~2u;
    v6 |= 0x40u;
  }
  if( *((_QWORD *)KeGetCurrentThread() + 23) != a1 )
  {
    v3 = 1;
    KiStackAttachProcess((_KPROCESS *)a1, 0i64, (_KAPC_STATE *)&LockHandle.WorkItem.Parameter);
  }
  SharedVm = MiGetSharedVm(v2);
  v8 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
  *((_DWORD *)SharedVm + 1) = 0;
  LockHandle.WorkItem.List.Flink = 0i64;
  LockHandle.WorkItem.List.Blink = (_LIST_ENTRY *)&WorkerRoutine;
  v9 = v8;
  KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)&WorkerRoutine, v10, v11);
  v17 = *(_DWORD *)(v2 + 184);
  v12 = v17;
  if( (v5 & 8) != 0 )
  {
    v12 = v17 & 0x7F;
    LOBYTE(v17) = v17 & 0x7F;
  }
  v13 = (v5 & 8) != 0;
  if( (v5 & 2) != 0 )
  {
    v12 &= ~0x40u;
    v13 = 1;
    LOBYTE(v17) = v12;
  }
  v14 = v6 | 0x80;
  if( v12 >= 0 )
    v14 = v6;
  v15 = v14 | 0x40;
  if( (v12 & 0x40) == 0 )
    v15 = v14;
  if( (v15 & 0x80) != 0
    && (v15 & 0x40) != 0
    && (unsigned __int64)(*(_QWORD *)(v2 + 112) + 6i64) >= *(_QWORD *)(v2 + 152) )
  {
    v5 = -6;
    v4 = -1073741748;
  }
  if( (v5 & 4) != 0 )
  {
    v12 |= 0x80u;
    v13 = 1;
    LOBYTE(v17) = v12;
  }
  if( (v5 & 1) != 0 )
  {
    v13 = 1;
    LOBYTE(v17) = v12 | 0x40;
  }
  if( v13 )
    *(_WORD *)(v2 + 184) = v17;
  KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
  MiUnlockWorkingSetExclusive(v2, v9);
  if( v3 )
    KiUnstackDetachProcess((KAPC_STATE *)&LockHandle.WorkItem.Parameter, 0i64);
  return v4;
}

Referenced by: