MmQuerySystemWorkingSetInformation

VOID __stdcall MmQuerySystemWorkingSetInformation(
        _WORKING_SET_TYPE WorkingSetType,
        _SYSTEM_FILECACHE_INFORMATION *Info){
  INT64 v4; 
  __int32 v5; 
  INT64 AnyMultiplexedVm; 
  int v7; 
  __int64 v8; 
  __int64 v9; 
  UINT8 v10; 
  WORK_QUEUE_TYPE v11; 
  PVOID v12; 
  char v13; 
  ULONG StandbyRepurposed; 
  SIZE_T CurrentSize; 
  SIZE_T PeakSizeIncludingTransitionInPages; 
  SIZE_T v17; 
  __int32 v18; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  Info->Flags = 0;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v4 = 2i64;
  v5 = WorkingSetType - 2;
  if( v5 )
  {
    v18 = v5 - 1;
    if( v18 )
    {
      if( v18 != 1 )
        return;
      v4 = 1i64;
    }
    AnyMultiplexedVm = (INT64)MiGetAnyMultiplexedVm(v4);
  }
  else
  {
    AnyMultiplexedVm = MiGetCurrentMultiplexedVm();
    if( !AnyMultiplexedVm )
    {
      memset((INT64)Info, 0i64);
      return;
    }
  }
  v8 = (unsigned int)(v7 - 2);
  v9 = *(_QWORD *)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(AnyMultiplexedVm + 174));
  v10 = MiLockWorkingSetShared(AnyMultiplexedVm);
  LockHandle.LockQueue.Next = 0i64;
  LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)(MiGetSharedVm(AnyMultiplexedVm) + 8);
  KxAcquireQueuedSpinLock((PIO_WORKITEM)&LockHandle, (PIO_WORKITEM_ROUTINE)LockHandle.LockQueue.Lock, v11, v12);
  Info->CurrentSize = *(_QWORD *)(AnyMultiplexedVm + 120);
  Info->PeakSize = *(_QWORD *)(AnyMultiplexedVm + 160);
  Info->PageFaultCount = *(_DWORD *)(AnyMultiplexedVm + 4);
  Info->MinimumWorkingSet = *(_QWORD *)(AnyMultiplexedVm + 112);
  Info->MaximumWorkingSet = *(_QWORD *)(AnyMultiplexedVm + 152);
  v13 = *(_BYTE *)(AnyMultiplexedVm + 184);
  if( v13 < 0 )
  {
    Info->Flags |= 4u;
    v13 = *(_BYTE *)(AnyMultiplexedVm + 184);
  }
  if( (v13 & 0x40) != 0 )
    Info->Flags |= 1u;
  Info->PeakSizeIncludingTransitionInPages = *(_QWORD *)(v9 + 8 * v8 + 4360);
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  MiUnlockWorkingSetShared(AnyMultiplexedVm, v10);
  StandbyRepurposed = MiGetStandbyRepurposed((_MI_PARTITION *)v9, 1ui64);
  CurrentSize = Info->CurrentSize;
  Info->TransitionRePurposeCount = StandbyRepurposed;
  PeakSizeIncludingTransitionInPages = Info->PeakSizeIncludingTransitionInPages;
  v17 = CurrentSize + *(_QWORD *)(v9 + 4352);
  Info->CurrentSizeIncludingTransitionInPages = v17;
  if( v17 > PeakSizeIncludingTransitionInPages )
    Info->CurrentSizeIncludingTransitionInPages = PeakSizeIncludingTransitionInPages;
  Info->PeakSize <<= 12;
  Info->CurrentSize = CurrentSize << 12;
}

Referenced by: