MiQueryAddressSpan

VOID *__stdcall MiQueryAddressSpan(_MEMORY_BASIC_INFORMATION *Info, VOID *Va, _MMVAD_SHORT *Vad){
  __int64 v3; 
  int v4; 
  _EPROCESS *v6; 
  unsigned __int64 v7; 
  _MMVAD_SHORT *v8; 
  unsigned __int64 v9; 
  _MMSUPPORT_FULL *p_Vm; 
  unsigned __int8 v12; 
  unsigned __int8 v13; 
  ULONG v14; 
  ULONG v15; 
  _MMVAD_SHORT *v16; 
  int v18; 
  UINT64 v19; 
  VOID *Vaa; 
  VOID *NextVaToQuery; 
  VOID *v22; 
  VOID *VaWithProto; 
  UINT64 ReturnedProtect; 

  v4 = 0;
  v6 = (_EPROCESS *)v3;
  v7 = *(unsigned int *)(v3 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v3 + 33) << 32);
  LODWORD(VaWithProto) = 0;
  v8 = Vad;
  v19 = 0i64;
  v9 = ((v7 << 12) | 0xFFF) + 1;
  Vaa = 0i64;
  LODWORD(ReturnedProtect) = 0;
  LOWORD(NextVaToQuery) = 0;
  LOWORD(v22) = 0;
  if( (unsigned __int64)Vad > v9 || !Vad )
    v8 = (_MMVAD_SHORT *)v9;
  p_Vm = &KeGetCurrentThread()->ApcState.Process->Vm;
  MiLockWorkingSetShared();
  v13 = v12;
  Info->Type = MiQueryAddressState(
                 Va,
                 (_BYTE)v8 - 1,
                 (_MMVAD_SHORT *)v12,
                 v6,
                 0i64,
                 &VaWithProto,
                 &ReturnedProtect,
                 &NextVaToQuery);
  if( (_DWORD)VaWithProto )
  {
    v14 = MmProtectToValue[(unsigned int)VaWithProto];
    *(&Info->Type + 1) = v14;
    v15 = ReturnedProtect | v14;
  }
  else
  {
    v15 = 0;
  }
  *(&Info->Type + 1) = v15;
  v16 = (_MMVAD_SHORT *)Vaa;
  LOWORD(Info->RegionSize) = (_WORD)NextVaToQuery;
  while( v16 < v8 )
  {
    if( MiQueryAddressState(
           v16,
           (_BYTE)v8 - 1,
           (_MMVAD_SHORT *)v13,
           v6,
           (UINT64)Info,
           (VOID **)&v19,
           (UINT64 *)((char *)&v19 + 4),
           &v22) != Info->Type
      || (_DWORD)v19 != (_DWORD)VaWithProto
      || (_WORD)v22 != (_WORD)NextVaToQuery
      || HIDWORD(v19) != (_DWORD)ReturnedProtect )
    {
      break;
    }
    v16 = (_MMVAD_SHORT *)Vaa;
    if( (++v4 & 0x1F) == 0 && (LOBYTE(v18) = MiWorkingSetIsContended((INT64)p_Vm), v18)
      || (unsigned int)KeShouldYieldProcessor() )
    {
      MiUnlockWorkingSetShared(&p_Vm->Instance, v13);
      MiLockWorkingSetShared();
    }
  }
  MiUnlockWorkingSetShared(&p_Vm->Instance, v13);
  return v16;
}

Referenced by: