HalpAuditQuerySlicAddresses

__int64 __fastcall HalpAuditQuerySlicAddresses(_LARGE_INTEGER *a1){
  ULONG v1; 
  unsigned int v3; 
  unsigned int *v4; 
  unsigned int *v5; 
  ULONG v6; 
  __int64 v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  VOID **PoolWithTag; 
  _LARGE_INTEGER v11; 
  ULONG v12; 
  __int64 v13; 
  unsigned int *v14; 
  _LARGE_INTEGER *v15; 
  _LARGE_INTEGER v16; 
  _DWORD *v17; 
  VOID *v18; 
  __int64 v20; 
  ULONG v21; 
  unsigned int *v22; 

  v1 = 4096 - (a1->anonymous_0.LowPart & 0xFFF);
  if( v1 < 0x24 )
    v1 = 36;
  v3 = 0;
  v21 = v1;
  do
  {
    v4 = (unsigned int *)MmMapIoSpaceEx(*a1, v1, 0x204ui64);
    v5 = v4;
    if( !v4 )
      return(unsigned int)-1073741823;
    v6 = v4[1];
    if( v1 < v6 )
    {
      MmUnmapIoSpace(v4, v1);
      v5 = 0i64;
      v21 = v6;
      v1 = v6;
    }
  }
  while( !v5 );
  v7 = v5[1];
  v8 = v7;
  if( (a1[1].anonymous_0.HighPart & 4) != 0 )
  {
    if( (unsigned int)v7 >= 0x24 )
      v8 = 36i64;
    v9 = (unsigned __int64)(v7 - v8) >> 3;
  }
  else
  {
    if( (unsigned int)v7 >= 0x24 )
      v8 = 36i64;
    v9 = (unsigned __int64)(v7 - v8) >> 2;
  }
  if( (_DWORD)v9 )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 8i64 * (unsigned int)v9, 543973704i64);
    v11.QuadPart = (LONGLONG)PoolWithTag;
    if( PoolWithTag )
    {
      memset(PoolWithTag, 0i64, 8 * v9);
      v12 = 0;
      v13 = (unsigned int)v9;
      v14 = v5 + 9;
      v15 = (_LARGE_INTEGER *)(v5 + 9);
      v22 = v5 + 9;
      do
      {
        if( (a1[1].anonymous_0.HighPart & 4) != 0 )
          v16 = *v15;
        else
          v16.QuadPart = *v14;
        v17 = MmMapIoSpaceEx(v16, 0x24ui64, 0x204ui64);
        v18 = v17;
        if( v17 )
        {
          if( *v17 == 1128877139 )
          {
            v20 = v12++;
            *(_LARGE_INTEGER *)(v11.QuadPart + 8 * v20) = v16;
          }
          MmUnmapIoSpace(v18, 0x24ui64);
        }
        ++v14;
        v15 = (_LARGE_INTEGER *)(v22 + 2);
        v22 += 2;
        --v13;
      }
      while( v13 );
      v1 = v21;
      a1[3] = v11;
      a1[2].anonymous_0.LowPart = v12;
    }
    else
    {
      v3 = -1073741801;
    }
  }
  MmUnmapIoSpace(v5, v1);
  return v3;
}

Referenced by: