MiFillActivePatchesQueryBuffer
UINT16 *__fastcall MiFillActivePatchesQueryBuffer(
INT64 a1,
INT64 a2,
INT64 a3,
INT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8,
UNICODE_STRING *SourceString){
UNICODE_STRING *v11;
UNICODE_STRING *v12;
unsigned __int16 Length;
UNICODE_STRING *v14;
UINT16 *result;
v11 = *(UNICODE_STRING **)a5;
v12 = *(UNICODE_STRING **)a6;
*(_QWORD *)&v11->Length = *(_QWORD *)a8;
Length = SourceString->Length;
v12->Length = SourceString->Length;
v12->MaximumLength = Length;
v12->Buffer = *(wchar_t **)a7;
RtlCopyUnicodeString(v12, SourceString, v11);
v14 = *(UNICODE_STRING **)a6;
*(_QWORD *)a5 += 8i64;
v14->Buffer = (wchar_t *)((char *)v14->Buffer - a4);
*(_QWORD *)a7 += v14->Length;
result = &v14[1].Length;
++*(_DWORD *)(a1 + 16);
*(_QWORD *)a6 = v14 + 1;
return result;
}Referenced by:
MiQueryProcessActivePatches