MmQueryMemoryListInformation
NTSTATUS __stdcall MmQueryMemoryListInformation(PVOID SystemInformation, UINT64 SystemInformationLength, UINT64 *a3){
unsigned int v3;
int v6;
ULONG_PTR *v7;
ULONG_PTR v8;
ULONG_PTR v9;
ULONG_PTR v10;
ULONG_PTR v11;
ULONG_PTR v12;
ULONG_PTR v13;
ULONG_PTR v14;
ULONG_PTR v15;
ULONG_PTR v16;
ULONG_PTR v17;
ULONG_PTR v18;
ULONG_PTR v19;
ULONG_PTR v20;
ULONG_PTR v21;
ULONG_PTR v22;
ULONG_PTR v23;
ULONG_PTR v24;
ULONG_PTR v25;
ULONG_PTR v26;
ULONG_PTR v27;
ULONG_PTR v28;
ULONG_PTR v29;
ULONG_PTR v30;
char v32;
ULONG_PTR *v33;
ULONG_PTR v34;
ULONG_PTR v35;
ULONG_PTR v36;
ULONG_PTR v37;
__int128 result;
__int128 v39;
__int128 v40;
__int128 v41;
__int128 v42;
__int128 v43;
__int128 v44;
__int128 v45;
__int128 v46;
__int128 v47;
__int128 v48;
_DWORD *v49;
v3 = (unsigned int)a3;
memset((INT64)&result, 0i64);
*((_QWORD *)&v48 + 1) = 0i64;
*v49 = 0;
if( v3 < 0xB0 )
{
*v49 = 176;
return -1073741820;
}
v6 = 0;
v32 = 0;
if( SystemInformation )
{
if( SystemInformation == (PVOID)-1i64 )
{
v7 = *(ULONG_PTR **)(qword_140C4E388
+ 8i64 * *(unsigned __int16 *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1838i64));
}
else
{
v7 = *(ULONG_PTR **)SystemInformation;
v6 = 1;
}
}
else
{
v7 = &MiSystemPartition;
}
v33 = v7;
if( *((_DWORD *)v7 + 2) != 305535296 )
goto LABEL_57;
if( v6 != 1 )
goto LABEL_7;
if( (PVOID)v7[22] != SystemInformation )
LABEL_57:
KeBugCheckEx(0x1Au, 0x41001ui64, (ULONG_PTR)SystemInformation, (ULONG_PTR)v7, 0i64);
if( !PsReferencePartitionSafe((INT64)SystemInformation) )
return -1073740640;
v32 = 1;
LABEL_7:
v8 = v7[866];
v34 = v7[280];
*(_QWORD *)&result = v34;
v35 = v7[288];
*((_QWORD *)&result + 1) = v35;
v9 = v7[936];
*(_QWORD *)&v39 = v9;
v36 = v7[944];
*((_QWORD *)&v39 + 1) = v36;
v37 = v7[512];
*(_QWORD *)&v40 = v37;
v10 = v7[950];
v11 = v7[304];
*((_QWORD *)&v40 + 1) = v11;
*((_QWORD *)&v44 + 1) = *((unsigned int *)v7 + 1070);
v12 = v7[309];
*(_QWORD *)&v41 = v12;
*(_QWORD *)&v45 = *((unsigned int *)v7 + 1071);
v13 = v7[314];
*((_QWORD *)&v41 + 1) = v13;
*((_QWORD *)&v45 + 1) = *((unsigned int *)v7 + 1072);
v14 = v7[319];
*(_QWORD *)&v42 = v14;
*(_QWORD *)&v46 = *((unsigned int *)v7 + 1073);
v15 = v7[324];
*((_QWORD *)&v42 + 1) = v15;
*((_QWORD *)&v46 + 1) = *((unsigned int *)v7 + 1074);
v16 = v7[329];
*(_QWORD *)&v43 = v16;
*(_QWORD *)&v47 = *((unsigned int *)v7 + 1075);
v17 = v7[334];
*((_QWORD *)&v43 + 1) = v17;
*((_QWORD *)&v47 + 1) = *((unsigned int *)v7 + 1076);
v18 = v7[339];
*(_QWORD *)&v44 = v18;
*(_QWORD *)&v48 = *((unsigned int *)v33 + 1077);
if( v34 > v8 )
{
*(_QWORD *)&result = v8;
v19 = 0i64;
}
else
{
v19 = v8 - v34;
}
if( v35 > v19 )
{
*((_QWORD *)&result + 1) = v19;
v20 = 0i64;
}
else
{
v20 = v19 - v35;
}
if( v9 > v20 )
{
v9 = v20;
*(_QWORD *)&v39 = v20;
v21 = 0i64;
}
else
{
v21 = v20 - v9;
}
if( v36 > v21 )
{
*((_QWORD *)&v39 + 1) = v21;
v22 = 0i64;
}
else
{
v22 = v21 - v36;
}
if( v37 > v22 )
{
*(_QWORD *)&v40 = v22;
v23 = 0i64;
}
else
{
v23 = v22 - v37;
}
if( v10 >= v9 )
v10 = v9;
*((_QWORD *)&v48 + 1) = v10;
if( v11 > v23 )
{
*((_QWORD *)&v40 + 1) = v23;
v24 = 0i64;
}
else
{
v24 = v23 - v11;
}
if( v12 > v24 )
{
*(_QWORD *)&v41 = v24;
v25 = 0i64;
}
else
{
v25 = v24 - v12;
}
if( v13 > v25 )
{
*((_QWORD *)&v41 + 1) = v25;
v26 = 0i64;
}
else
{
v26 = v25 - v13;
}
if( v14 > v26 )
{
*(_QWORD *)&v42 = v26;
v27 = 0i64;
}
else
{
v27 = v26 - v14;
}
if( v15 > v27 )
{
*((_QWORD *)&v42 + 1) = v27;
v28 = 0i64;
}
else
{
v28 = v27 - v15;
}
if( v16 > v28 )
{
*(_QWORD *)&v43 = v28;
v29 = 0i64;
}
else
{
v29 = v28 - v16;
}
if( v17 > v29 )
{
*((_QWORD *)&v43 + 1) = v29;
v30 = 0i64;
}
else
{
v30 = v29 - v17;
}
if( v18 > v30 )
*(_QWORD *)&v44 = v30;
*(_OWORD *)SystemInformationLength = result;
*(_OWORD *)(SystemInformationLength + 16) = v39;
*(_OWORD *)(SystemInformationLength + 32) = v40;
*(_OWORD *)(SystemInformationLength + 48) = v41;
*(_OWORD *)(SystemInformationLength + 64) = v42;
*(_OWORD *)(SystemInformationLength + 80) = v43;
*(_OWORD *)(SystemInformationLength + 96) = v44;
*(_OWORD *)(SystemInformationLength + 112) = v45;
*(_OWORD *)(SystemInformationLength + 128) = v46;
*(_OWORD *)(SystemInformationLength + 144) = v47;
*(_OWORD *)(SystemInformationLength + 160) = v48;
*v49 = 176;
if( v32 )
PsDereferencePartition(v33[22]);
return 0;
}Referenced by:
EtwpLogMemInfo
ExpQuerySystemInformation
PfSnCheckActionsNeeded
PfpMemoryListQuery
PfpPfnPrioRequest
PfpPrefetchDirectoryStream
PfpPrefetchFilesTrickle
PfpPrefetchPrivatePages
PfpUpdateRepurposedByPrefetch
PfpVolumePrefetchMetadata