MmGetSectionInformation
INT64 __fastcall MmGetSectionInformation(INT64 a1, INT64 a2, INT64 a3){
int v4;
_CONTROL_AREA *v6;
int v7;
__int64 v8;
LARGE_INTEGER *v9;
int v10;
int v12;
int v13;
int v14;
int v15;
__int16 v16;
int v17;
__int64 v18;
__int64 v19;
__int128 *v20;
__int128 v21;
__int128 v22;
__int128 v23;
__int128 v24;
_DWORD *v25;
__int64 v26;
int v27;
int v28;
int v29;
INT64 result[2];
__int64 v31;
v4 = a2;
memset((INT64)result, 0i64);
v6 = MiSectionControlArea((_SECTION *)a1);
if( MiAweControlArea((INT64)v6) )
return 3221225485i64;
if( !v4 )
{
v12 = ((v10 & 0x1000) << 14) | 0x8000000;
if( (v10 & 0x2000) == 0 )
v12 = (v10 & 0x1000) << 14;
if( (v10 & 0x20) != 0 )
v12 = 0x1000000;
v13 = v12 | 0x200000;
if( (v10 & 0x40) == 0 )
v13 = v12;
v14 = v13 | 0x800000;
if( (v10 & 0x80u) == 0 )
v14 = v13;
v15 = v14 | 0x80000;
if( v10 >= 0 )
v15 = v14;
v16 = *(_WORD *)(v9->QuadPart + 12);
v17 = v15 | 0x10000000;
if( v16 >= 0 )
v17 = v15;
v7 = v17 | 0x40000000;
if( (v16 & 0x4000) == 0 )
v7 = v17;
if( (v9[7].LowPart & 0x20020) == 131104 )
v7 |= 0x20000000u;
}
if( v4 )
{
if( v4 == 1 || v4 == 4 )
{
if( (v10 & 0x20) != 0 )
{
v20 = *(__int128 **)(v9->QuadPart + 56);
v21 = *v20;
*(_OWORD *)result = *v20;
v22 = v20[1];
v23 = v20[2];
v24 = v20[3];
if( (v9[7].LowPart & 0x10000000) != 0 )
{
result[0] = qword_140C4DB50 | LOWORD(result[0]);
v21 = *(_OWORD *)result;
}
if( v4 == 4 )
{
LODWORD(v25) = MiGetControlAreaLoadConfig(v9);
v27 = v8;
LODWORD(v31) = v8;
v28 = v8;
if( v25 && (*v25 & 0x10) != 0 )
{
v27 = 1;
LODWORD(v31) = 1;
v28 = 1;
}
v29 = *(_DWORD *)(v26 + 76);
if( (v29 & 1) != 0 )
{
v27 = v28 | 2;
LODWORD(v31) = v28 | 2;
v28 |= 2u;
}
if( (v29 & 2) != 0 )
{
v27 = v28 | 8;
LODWORD(v31) = v28 | 8;
v28 |= 8u;
}
if( (v29 & 4) != 0 )
{
v27 = v28 | 0x10;
LODWORD(v31) = v28 | 0x10;
}
if( (v29 & 8) != 0 )
{
v27 |= 0x20u;
LODWORD(v31) = v27;
}
if( (v29 & 0x10) != 0 )
{
v27 |= 0x40u;
LODWORD(v31) = v27;
}
if( (v29 & 0x20) != 0 )
LODWORD(v31) = v27 | 0x80;
*(_OWORD *)a3 = v21;
*(_OWORD *)(a3 + 16) = v22;
*(_OWORD *)(a3 + 32) = v23;
*(_OWORD *)(a3 + 48) = v24;
*(_QWORD *)(a3 + 64) = v31;
}
else
{
*(_OWORD *)a3 = v21;
*(_OWORD *)(a3 + 16) = v22;
*(_OWORD *)(a3 + 32) = v23;
*(_OWORD *)(a3 + 48) = v24;
}
return(unsigned int)v8;
}
}
else if( (v10 & 0x20) != 0 )
{
v18 = *(_QWORD *)(v9[12].QuadPart + 32);
if( v18 )
v19 = *(_QWORD *)(v18 + 40);
else
v19 = v8;
if( v4 == 2 )
{
if( (v9[7].LowPart & 0x10000000) != 0 )
v19 += qword_140C4DB50 - *(_QWORD *)(v9->QuadPart + 32);
*(_QWORD *)a3 = v19;
}
else
{
*(_QWORD *)a3 = *(_QWORD *)(v9->QuadPart + 32) - v19;
}
return(unsigned int)v8;
}
LODWORD(v8) = -1073741751;
}
else
{
*(_QWORD *)a3 = *(_QWORD *)(a1 + 24) << 12;
*(_QWORD *)(a3 + 16) = *(_QWORD *)(a1 + 48);
*(_DWORD *)(a3 + 8) = v7;
}
return(unsigned int)v8;
}Referenced by:
AlpcpMapLegacyPortView
DbgkpSendErrorMessage
NtQueryInformationProcess
NtQuerySection
PspAllocateProcess
PspLocateSystemDll