NtQueryInformationAtom

NTSTATUS __fastcall NtQueryInformationAtom(UINT16 a1, INT64 a2, UINT64 a3, UINT64 a4, INT64 *ReturnLength){
  unsigned int v5; 
  int v7; 
  __int64 v9; 
  int v10; 
  int AtomsInAtomTable; 
  int v12; 
  UINT64 AtomUsage; 
  int v15; 
  UINT64 AtomFlags; 
  VOID *AtomTableHandle; 
  _ETHREAD *CurrentThread; 

  v5 = a4;
  v7 = a2;
  LODWORD(AtomFlags) = 0;
  AtomTableHandle = 0i64;
  AtomUsage = 0i64;
  PsInvokeWin32Callout(Win32GlobalAtomTableCallout, &AtomTableHandle, PsWin32SessionAttachNone, 0i64);
  if( !AtomTableHandle )
    return -1073741790;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( CurrentThread->Tcb.PreviousMode )
  {
    ProbeForWrite(a3, v5, 4i64);
    if( ReturnLength )
    {
      v9 = 0x7FFFFFFF0000i64;
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v9 = (__int64)ReturnLength;
      *(_DWORD *)v9 = *(_DWORD *)v9;
    }
  }
  v10 = 0;
  if( v7 )
  {
    if( v7 == 1 )
    {
      v10 = 4;
      if( v5 < 4 )
        return -1073741820;
      AtomsInAtomTable = RtlQueryAtomsInAtomTable(AtomTableHandle, (v5 - 4) >> 1, (UINT64 *)a3, (UINT16 *)(a3 + 4));
      v15 = AtomsInAtomTable;
      if( AtomsInAtomTable >= 0 )
        v10 = 2 * *(_DWORD *)a3 + 4;
    }
    else
    {
      AtomsInAtomTable = -1073741821;
      v15 = -1073741821;
    }
  }
  else
  {
    v10 = 6;
    if( v5 < 6 )
      return -1073741820;
    LODWORD(AtomUsage) = 0;
    HIDWORD(AtomUsage) = v5 - 6;
    AtomsInAtomTable = RtlQueryAtomInAtomTable(
                         AtomTableHandle,
                         a1,
                         &AtomUsage,
                         &AtomFlags,
                         (WCHAR *)(a3 + 6),
                         (UINT64 *)((char *)&AtomUsage + 4));
    v15 = AtomsInAtomTable;
    if( AtomsInAtomTable >= 0 )
    {
      *(_WORD *)a3 = AtomUsage;
      *(_WORD *)(a3 + 2) = AtomFlags;
      v12 = HIDWORD(AtomUsage);
      *(_WORD *)(a3 + 4) = WORD2(AtomUsage);
      v10 = v12 + 8;
    }
  }
  if( ReturnLength )
    *(_DWORD *)ReturnLength = v10;
  return AtomsInAtomTable;
}

Referenced by: