MmGetImageInformation

INT64 __fastcall MmGetImageInformation(UINT64 a1, _QWORD *a2, _QWORD *a3, INT64 *a4){
  _ETHREAD *CurrentThread; 
  unsigned int v10; 
  int v11; 
  INT64 v12; 
  INT64 **v13; 
  if( a1 > 0x7FFFFFFEFFFFi64 )
    return 3221225485i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v10 = 0;
  v11 = 0;
  v12 = *((_QWORD *)CurrentThread + 23);
  if( (*((_DWORD *)CurrentThread + 326) & 3) == 0 )
  {
    v11 = 1;
    LOCK_ADDRESS_SPACE_SHARED(CurrentThread, *((_EPROCESS **)CurrentThread + 23));
  }
  v13 = MiCheckForConflictingVad(v12, a1, a1);
  if( v13 )
  {
    if( ((_DWORD)v13[6] & 0x70) == 32 )
    {
      *a2 = (*((unsigned int *)v13 + 6) | ((unsigned __int64)*((unsigned __int8 *)v13 + 32) << 32)) << 12;
      *a3 = ((*((unsigned int *)v13 + 7) | ((unsigned __int64)*((unsigned __int8 *)v13 + 33) << 32))
           - (*((unsigned int *)v13 + 6) | ((unsigned __int64)*((unsigned __int8 *)v13 + 32) << 32))
           + 1) << 12;
      *(_DWORD *)a4 = *(_DWORD *)(*(_QWORD *)(*(_QWORD *)*v13[9] + 56i64) + 76i64) & 1;
    }
    else
    {
      v10 = -1073741751;
    }
  }
  else
  {
    v10 = -1073741800;
  }
  if( v11 == 1 )
    UNLOCK_ADDRESS_SPACE_SHARED((__int64)CurrentThread, v12);
  return v10;
}

Referenced by: