MmQueryProcessWorkingSetSwapPages
__int64 __fastcall MmQueryProcessWorkingSetSwapPages(__int64 a1, _QWORD *a2){
INT64 v2;
unsigned int v5;
__int64 v6;
unsigned __int64 v7;
unsigned __int64 WorkingSetSwapSupport;
v2 = a1 + 1664;
if( (unsigned __int64)MiGetWorkingSetSwapSupport(a1 + 1664) <= 2 )
return 3221226021i64;
v5 = -1073741275;
v6 = *(_QWORD *)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(v2 + 174));
v7 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)(v6 + 1136));
WorkingSetSwapSupport = MiGetWorkingSetSwapSupport(v2);
if( WorkingSetSwapSupport > 2 )
{
v5 = 0;
*a2 = *(_QWORD *)(*(_QWORD *)WorkingSetSwapSupport + 24i64);
}
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v6 + 1136));
__writecr8(v7);
return v5;
}Referenced by:
PfpPrivSourceEnum
SmStoreCompressionStart
SmStoreCompressionStop