ExpQuerySingleModuleInformation

NTSTATUS __stdcall ExpQuerySingleModuleInformation(
        PVOID SystemInformation,
        UINT64 ModuleInformationLength,
        INT8 PreviousMode,
        UINT64 *ReturnLength){
  _ETHREAD *CurrentThread; 
  unsigned __int64 v8; 
  PVOID *v9; 
  INT16 v10; 
  PVOID v11; 
  NTSTATUS v12; 
  *(_DWORD *)ReturnLength = 0;
  if( PreviousMode )
    return -1073741790;
  if( (unsigned int)ModuleInformationLength < 0x148 )
    return -1073741820;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v8 = *(_QWORD *)SystemInformation;
  --*((_WORD *)CurrentThread + 242);
  ExAcquireResourceExclusiveLite(&PsLoadedModuleResource, 1u);
  v9 = (PVOID *)PsLoadedModuleList;
  v10 = 0;
  if( PsLoadedModuleList )
  {
    while( v9 != &PsLoadedModuleList )
    {
      v11 = v9[6];
      if( v8 >= (unsigned __int64)v11 && v8 < (unsigned __int64)v11 + *((unsigned int *)v9 + 16) )
      {
        *((_WORD *)SystemInformation + 4) = 0;
        ExpConvertLdrEntryToModuleInfo((INT64)v9, v10, (INT64)SystemInformation + 8);
        v12 = 0;
        goto LABEL_11;
      }
      v9 = (PVOID *)*v9;
      ++v10;
    }
  }
  v12 = -1073741275;
LABEL_11:
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( v12 >= 0 )
    *(_DWORD *)ReturnLength = 328;
  return v12;
}

Referenced by: