MmProcessWorkingSetControl

NTSTATUS __stdcall MmProcessWorkingSetControl(
        PVOID ProcessHandle,
        PVOID ProcessInformation,
        UINT64 ProcessInformationLength,
        INT8 PreviousMode){
  unsigned int v6; 
  NTSTATUS result; 
  char *v8; 
  NTSTATUS v9; 
  NTSTATUS v10; 
  CHAR v11; 
  __int64 v12; 
  int v13; 
  PVOID Object[2]; 
  _KAPC_STATE ApcState; 
  Object[1] = ProcessHandle;
  v6 = 0;
  Object[0] = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  if( (unsigned int)ProcessInformationLength < 0xC )
    return -1073741820;
  v12 = *(_QWORD *)ProcessInformation;
  v13 = *((_DWORD *)ProcessInformation + 2);
  if( (unsigned int)*(_QWORD *)ProcessInformation != 3 )
    return -1073741735;
  if( HIDWORD(v12) >= 2 )
    return -1073741811;
  if( !HIDWORD(v12) && !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
    return -1073741727;
  result = ObpReferenceObjectByHandleWithTag(
             (ULONG_PTR)ProcessHandle,
             0x2000,
             (__int64)PsProcessType,
             PreviousMode,
             0x73576D4Du,
             (__int64)Object,
             0i64,
             0i64);
  if( result >= 0 )
  {
    v8 = (char *)Object[0];
    if( *((PVOID *)KeGetCurrentThread() + 23) == Object[0] )
    {
      LODWORD(Object[0]) = 0;
    }
    else
    {
      LODWORD(Object[0]) = 1;
      KiStackAttachProcess((_KPROCESS *)v8, 0i64, &ApcState);
    }
    if( HIDWORD(v12) )
    {
      if( (v13 & 0xFFFFFFC0) == 0 )
      {
        if( ((v13 & 0x20) == 0 || !PreviousMode)
          && (v13 & 1) != ((v13 & 2) == 0)
          && ((v13 & 8) == 0 || (v13 & 2) != 0)
          && ((v13 & 0x10) == 0 || (v13 & 8) != 0) )
        {
          MiLogWsEmptyControl((INT64)(v8 + 1664));
          if( (v13 & 1) != 0 )
          {
            if( (v13 & 8) != 0 )
              SmStoreCompressionStart();
            v9 = MiEmptyWorkingSetPrivatePagesByVa((_MMSUPPORT_INSTANCE *)(v8 + 1664));
            if( (v13 & 8) != 0 )
            {
              LOBYTE(v6) = (v13 & 0x10) != 0;
              SmStoreCompressionStop(v6);
            }
            goto LABEL_20;
          }
          v11 = ((v13 & 0x20) != 0 ? 4 : 0) | 1;
          if( (v13 & 4) == 0 )
            v11 = (v13 & 0x20) != 0 ? 4 : 0;
          v10 = MiEmptyWorkingSet((INT64)(v8 + 1664), v11);
          goto LABEL_40;
        }
        v9 = -1073741637;
LABEL_20:
        if( LODWORD(Object[0]) == 1 )
          KiUnstackDetachProcess(&ApcState, 0i64);
        ObfDereferenceObjectWithTag(v8, 0x73576D4Dui64);
        return v9;
      }
    }
    else if( (v13 & 0xFFFFFFFE) == 0 )
    {
      v10 = PsSwapProcessWorkingSet((ULONG_PTR)v8, (v13 & 1) == 0);
LABEL_40:
      v9 = v10;
      goto LABEL_20;
    }
    v9 = -1073741811;
    goto LABEL_20;
  }
  return result;
}

Referenced by: