HalpDmaFinalizeDoubleBufferingDisposition
VOID __stdcall HalpDmaFinalizeDoubleBufferingDisposition(){
void *v0;
char *v1;
NTSTATUS v2;
void *PoolWithTag;
UINT64 v4;
UINT8 *v5;
__int64 v6;
unsigned __int64 v7;
ULONG ResultLength;
UINT8 dst[4];
void *KeyHandle;
struct _UNICODE_STRING ValueName;
__int64 v12[2];
struct _OBJECT_ATTRIBUTES ObjectAttributes;
char KeyValueInformation[16];
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
ResultLength = 0;
v12[1] = (__int64)L"\\Registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management";
v0 = 0i64;
KeyHandle = 0i64;
ObjectAttributes.RootDirectory = 0i64;
ValueName.Buffer = L"DynamicMemory";
v12[0] = 11141288i64;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)v12;
*(_QWORD *)&ValueName.Length = 1835034i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
if( !ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes) )
{
v1 = KeyValueInformation;
v2 = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, KeyValueInformation, 0x10u, &ResultLength);
if( (v2 == -2147483643 || v2 == -1073741789) && ResultLength > 0x10 )
{
PoolWithTag = ExAllocatePoolWithTag(PagedPool, ResultLength, 0x206C6148ui64);
v0 = PoolWithTag;
if( !PoolWithTag )
{
LABEL_7:
if( KeyHandle )
ZwClose(KeyHandle);
return;
}
v1 = (char *)PoolWithTag;
v2 = ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, PoolWithTag, ResultLength, &ResultLength);
}
if( !v2 )
{
v4 = *((unsigned int *)v1 + 2);
v5 = (UINT8 *)(v1 + 12);
if( (unsigned int)v4 < 4 )
{
*(_DWORD *)dst = 0;
memmove(dst, v5, v4);
v6 = *(unsigned int *)dst;
}
else
{
v6 = *(unsigned int *)v5;
}
v7 = (v6 << 30) - 1;
if( v7 > HalpMaximumPhysicalMemoryAddress )
HalpMaximumPhysicalMemoryAddress = v7;
}
if( v0 )
ExFreePoolWithTag(v0, 0x206C6148u);
goto LABEL_7;
}
}Referenced by:
HalpDmaInitSystem