MmQueryWorkingSetInformation

INT64 __fastcall MmQueryWorkingSetInformation(
        UINT64 *PeakWorkingSetSize,
        UINT64 *WorkingSetSize,
        UINT64 *PrivateWorkingSetSize,
        UINT64 *MinimumWorkingSetSize,
        UINT64 *MaximumWorkingSetSize,
        UINT *HardEnforcementFlags){
  INT64 v10; 
  UINT8 v11; 
  char v12; 
  *HardEnforcementFlags = 0;
  v10 = *((_QWORD *)KeGetCurrentThread() + 23) + 1664i64;
  v11 = MiLockWorkingSetShared(v10);
  *PeakWorkingSetSize = *(_QWORD *)(v10 + 160) << 12;
  *WorkingSetSize = *(_QWORD *)(v10 + 120) << 12;
  *PrivateWorkingSetSize = *(_QWORD *)(v10 + 128) << 12;
  *MinimumWorkingSetSize = *(_QWORD *)(v10 + 112) << 12;
  *MaximumWorkingSetSize = *(_QWORD *)(v10 + 152) << 12;
  v12 = *(_BYTE *)(v10 + 184);
  if( v12 < 0 )
  {
    *HardEnforcementFlags |= 4u;
    v12 = *(_BYTE *)(v10 + 184);
  }
  if( (v12 & 0x40) != 0 )
    *HardEnforcementFlags |= 1u;
  MiUnlockWorkingSetShared(v10, v11);
  return 0i64;
}

Referenced by: