VmpPauseResumeNotify

INT64 __fastcall VmpPauseResumeNotify(INT64 a1, INT64 a2){
  _ETHREAD *CurrentThread; 
  int v3; 
  int v5; 
  volatile INT64 *v6; 
  unsigned int v7; 
  NTSTATUS v8; 
  int v9; 
  int i; 
  __int64 v11; 
  int v12; 
  bool v13; 
  int v14; 
  int v15; 
  unsigned int v16; 
  int ProcessInformation; 
  __int64 v19; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = a2;
  v5 = 4;
  --*((_WORD *)CurrentThread + 242);
  v6 = (volatile INT64 *)(a1 + 96);
  ExAcquirePushLockExclusiveEx(a1 + 96, 0i64);
  v7 = *(_DWORD *)(a1 + 104);
  if( (v7 & 1) != 0 )
  {
    v8 = -1073740682;
    goto LABEL_31;
  }
  v9 = (v7 >> 1) & 3;
  if( v3 )
  {
    if( v9 >= v3 )
    {
      v8 = -1073741811;
      goto LABEL_31;
    }
  }
  else if( !v9 )
  {
    v8 = 1075380276;
    goto LABEL_31;
  }
  *(_DWORD *)(a1 + 104) = v7 | 1;
  if( (_InterlockedExchangeAdd64(v6, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v6);
  KeAbPostRelease((PVOID)v6);
  v19 = 0i64;
  ProcessInformation = 3;
  if( v3 )
  {
    for( i = v9 + 1; ; ++i )
    {
      if( i > v3 )
      {
        v5 = v3;
        goto LABEL_28;
      }
      if( i == 1 )
      {
        if( *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1792i64) << 12 >> 20 > (unsigned __int64)(unsigned int)VmPauseOutswapSizeCapMB )
          continue;
        v19 = 0i64;
      }
      else
      {
        if( (unsigned int)(i - 2) > 1 )
          continue;
        MiGetProcessPartition(*((_EPROCESS **)KeGetCurrentThread() + 23));
        if( !*(_DWORD *)(v11 + 1160) && i != 3 )
          continue;
        v12 = 3;
        v13 = (*(_DWORD *)(a1 + 88) & 1) == 0;
        v14 = *(_DWORD *)(a1 + 88) & 1;
        LODWORD(v19) = 1;
        if( !v13 )
          v12 = 35;
        HIDWORD(v19) = v12;
        v15 = 32 * v14 + 3;
        if( SmStoreExistsForProcess(*((_QWORD *)KeGetCurrentThread() + 23)) )
        {
          HIDWORD(v19) = v15 | 8;
          if( i == 3 )
            HIDWORD(v19) = v15 | 0x18;
        }
      }
      v8 = MmProcessWorkingSetControl((PVOID)0xFFFFFFFFFFFFFFFFi64, &ProcessInformation, 0xCui64, 0);
      if( v8 < 0 )
        goto LABEL_29;
    }
  }
  v19 = 0x100000000i64;
  MmProcessWorkingSetControl((PVOID)0xFFFFFFFFFFFFFFFFi64, &ProcessInformation, 0xCui64, 0);
  v5 = 0;
LABEL_28:
  v8 = 0;
LABEL_29:
  ExAcquirePushLockExclusiveEx((UINT64)v6, 0i64);
  v16 = *(_DWORD *)(a1 + 104) & 0xFFFFFFFE;
  *(_DWORD *)(a1 + 104) = v16;
  if( v5 != 4 )
    *(_DWORD *)(a1 + 104) = v16 ^ ((unsigned __int8)v16 ^ (unsigned __int8)(2 * v5)) & 6;
LABEL_31:
  if( (_InterlockedExchangeAdd64(v6, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v6);
  KeAbPostRelease((PVOID)v6);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return(unsigned int)v8;
}

Referenced by: