sub_14065E218

__int64 __fastcall sub_14065E218(PVOID BaseAddress, unsigned int a2, int a3){
  __int64 v3; 
  __int64 v6; 
  NTSTATUS v7; 
  __int64 v8; 
  ULONG_PTR v10; 
  __int128 MemoryInformation; 
  __int64 v12; 
  __int128 v13; 
  __int128 v14; 
  __int128 v15; 
  UINT64 ReturnLength; 
  v3 = a2;
  v10 = 0i64;
  ReturnLength = 0i64;
  v12 = 0i64;
  v13 = 0i64;
  v14 = 0i64;
  v15 = 0i64;
  MemoryInformation = 0i64;
  v7 = ZwQueryVirtualMemory(
         (PVOID)0xFFFFFFFFFFFFFFFFi64,
         BaseAddress,
         MemoryWorkingSetExList|MemorySectionName,
         &MemoryInformation,
         0x18ui64,
         &ReturnLength);
  if( v7 >= 0 )
  {
    v8 = (unsigned int)v12 >> 2;
    LOBYTE(v8) = v8 & 0xF;
    if( qword_140C1D900 && (LOBYTE(v6) = 12, (unsigned int)qword_140C1D900(v8, v6)) )
    {
      v7 = 0;
      if( a3 )
      {
        v7 = ZwQueryVirtualMemory(
               (PVOID)0xFFFFFFFFFFFFFFFFi64,
               BaseAddress,
               MemoryBasicInformation,
               &v13,
               0x30ui64,
               &v10);
        if( v7 >= 0
          && ((unsigned __int64)BaseAddress < (unsigned __int64)v13
           || (unsigned __int64)BaseAddress + v3 > *((_QWORD *)&v14 + 1) + (_QWORD)v13
           || DWORD1(v15) != 32) )
        {
          return(unsigned int)-1073741811;
        }
      }
    }
    else
    {
      return(unsigned int)-1073740760;
    }
  }
  return(unsigned int)v7;
}

Referenced by:

WbCreateHeapExecutedBlock
WbDecryptWarbirdEncryptionSegmentBlockV0
WbInitializeEncryptionSegment
sub_1405D27A4
sub_140963C98
sub_140963E88