MmGetSectionRange

NTSTATUS __stdcall MmGetSectionRange(VOID *AddressWithinSection, VOID **StartingSectionAddress, UINT64 *SizeofSection){
  _ETHREAD *CurrentThread; 
  NTSTATUS v7; 
  _LIST_ENTRY *v8; 
  _LIST_ENTRY *v9; 
  UINT64 Flink; 
  char *v11; 
  __int64 v12; 
  int v13; 
  unsigned int *v14; 
  unsigned int v15; 
  unsigned __int64 v16; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v7 = -1073741275;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceSharedLite((UINT64)&PsLoadedModuleResource, 1);
  v8 = MiLookupDataTableEntry(AddressWithinSection, 0i64);
  v9 = v8;
  if( v8 )
  {
    Flink = (UINT64)v8[3].Flink;
    v11 = (char *)AddressWithinSection - Flink;
    LODWORD(v12) = RtlImageNtHeader(Flink);
    v13 = 0;
    if( *(_WORD *)(v12 + 6) )
    {
      v14 = (unsigned int *)(v12 + *(unsigned __int16 *)(v12 + 20) + 32i64);
      while( 1 )
      {
        v15 = v14[2];
        v16 = v14[1];
        if( v15 < *v14 )
          v15 = *v14;
        if( (unsigned __int64)v11 >= v16 && (unsigned __int64)v11 < v15 + (unsigned int)v16 )
          break;
        v14 += 10;
        if( ++v13 >= (unsigned int)*(unsigned __int16 *)(v12 + 6) )
          goto LABEL_11;
      }
      *(_DWORD *)SizeofSection = v15;
      *StartingSectionAddress = (char *)v9[3].Flink + v16;
      v7 = 0;
    }
  }
LABEL_11:
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v7;
}

Referenced by: