sub_14065E218
__int64 __fastcall sub_14065E218(PVOID BaseAddress, unsigned int a2, int a3){
__int64 v3;
__int64 v6;
NTSTATUS v7;
__int64 v8;
ULONG_PTR v10;
__int128 MemoryInformation;
__int64 v12;
__int128 v13;
__int128 v14;
__int128 v15;
UINT64 ReturnLength;
v3 = a2;
v10 = 0i64;
ReturnLength = 0i64;
v12 = 0i64;
v13 = 0i64;
v14 = 0i64;
v15 = 0i64;
MemoryInformation = 0i64;
v7 = ZwQueryVirtualMemory(
(PVOID)0xFFFFFFFFFFFFFFFFi64,
BaseAddress,
MemoryWorkingSetExList|MemorySectionName,
&MemoryInformation,
0x18ui64,
&ReturnLength);
if( v7 >= 0 )
{
v8 = (unsigned int)v12 >> 2;
LOBYTE(v8) = v8 & 0xF;
if( qword_140C1D900 && (LOBYTE(v6) = 12, (unsigned int)qword_140C1D900(v8, v6)) )
{
v7 = 0;
if( a3 )
{
v7 = ZwQueryVirtualMemory(
(PVOID)0xFFFFFFFFFFFFFFFFi64,
BaseAddress,
MemoryBasicInformation,
&v13,
0x30ui64,
&v10);
if( v7 >= 0
&& ((unsigned __int64)BaseAddress < (unsigned __int64)v13
|| (unsigned __int64)BaseAddress + v3 > *((_QWORD *)&v14 + 1) + (_QWORD)v13
|| DWORD1(v15) != 32) )
{
return(unsigned int)-1073741811;
}
}
}
else
{
return(unsigned int)-1073740760;
}
}
return(unsigned int)v7;
}Referenced by:
WbCreateHeapExecutedBlock
WbDecryptWarbirdEncryptionSegmentBlockV0
WbInitializeEncryptionSegment
sub_1405D27A4
sub_140963C98
sub_140963E88