MmQuerySystemWorkingSetInformation

VOID *__fastcall MmQuerySystemWorkingSetInformation(int a1, unsigned __int64 *a2){
  VOID *result; 
  _MI_WORKING_SET_TYPE v5; 
  int v6; 
  int v7; 
  _MMSUPPORT_INSTANCE *v8; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  __int64 v10; 
  _MI_PARTITION *v11; 
  char v12; 
  char v13; 
  char bf_0; 
  UINT64 v15; 
  NTSTATUS StandbyRepurposed; 
  unsigned __int64 v17; 
  unsigned __int64 v18; 
  unsigned __int64 v19; 
  _KLOCK_QUEUE_HANDLE LockQueue; 

  result = 0i64;
  *((_DWORD *)a2 + 15) = 0;
  memset(&LockQueue, 0, sizeof(LockQueue));
  v5 = MiWorkingSetTypePagedPool;
  v6 = a1 - 2;
  if( v6 )
  {
    v19 = (unsigned int)(v6 - 1);
    if( (_DWORD)v19 )
    {
      if( (_DWORD)v19 != 1 )
        return result;
      v5 = MiWorkingSetTypeSystemViews;
    }
    AnyMultiplexedVm = MiGetAnyMultiplexedVm(v5, (VOID *)v19);
  }
  else
  {
    MiGetCurrentMultiplexedVm();
    AnyMultiplexedVm = v8;
    if( !v8 )
      return memset(a2, 0i64, 0x40u);
  }
  v10 = (unsigned int)(v7 - 2);
  v11 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * AnyMultiplexedVm->PartitionId);
  MiLockWorkingSetShared();
  v13 = v12;
  LockQueue.LockQueue.Next = 0i64;
  LockQueue.LockQueue.Lock = &MiGetSharedVm(AnyMultiplexedVm)->WorkingSetCoreLock;
  KxAcquireQueuedSpinLock(&LockQueue.LockQueue, LockQueue.LockQueue.Lock);
  *a2 = AnyMultiplexedVm->WorkingSetLeafSize;
  a2[1] = AnyMultiplexedVm->PeakWorkingSetSize;
  *((_DWORD *)a2 + 4) = AnyMultiplexedVm->PageFaultCount;
  a2[3] = AnyMultiplexedVm->MinimumWorkingSetSize;
  a2[4] = AnyMultiplexedVm->MaximumWorkingSetSize;
  bf_0 = AnyMultiplexedVm->Flags._bf_0;
  if( bf_0 < 0 )
  {
    *((_DWORD *)a2 + 15) |= 4u;
    bf_0 = AnyMultiplexedVm->Flags._bf_0;
  }
  if( (bf_0 & 0x40) != 0 )
    *((_DWORD *)a2 + 15) |= 1u;
  a2[6] = v11->PageLists.TransitionSharedPagesPeak[v10];
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockQueue);
  LOBYTE(v15) = v13;
  MiUnlockWorkingSetShared(AnyMultiplexedVm, v15);
  StandbyRepurposed = MiGetStandbyRepurposed(v11, 1ui64);
  v17 = *a2;
  *((_DWORD *)a2 + 14) = StandbyRepurposed;
  result = (VOID *)a2[6];
  v18 = v17 + v11->PageLists.TransitionSharedPages;
  a2[5] = v18;
  if( v18 > (unsigned __int64)result )
    a2[5] = (unsigned __int64)result;
  a2[1] <<= 12;
  *a2 = v17 << 12;
  return result;
}

Referenced by: