MiReadWriteVirtualMemory

INT64 __stdcall MiReadWriteVirtualMemory(
        VOID *ProcessHandle,
        VOID *BaseAddress,
        VOID *Buffer,
        UINT64 BufferSize,
        UINT64 *BytesTransferred,
        UINT64 VmOperation){
  _ETHREAD *CurrentThread; 
  KPROCESSOR_MODE v9; 
  UINT64 *v10; 
  __int64 v11; 
  int v12; 
  _LIST_ENTRY *v13; 
  PVOID v14; 
  _LIST_ENTRY *v15; 
  VOID *v16; 
  _HHIVE *v17; 
  INT64 v18; 
  PVOID Object[2]; 
  Object[0] = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v9 = *((_BYTE *)CurrentThread + 562);
  if( v9 )
  {
    if( (char *)BaseAddress + BufferSize < BaseAddress
      || (unsigned __int64)BaseAddress + BufferSize > 0x7FFFFFFF0000i64
      || (char *)Buffer + BufferSize < Buffer
      || (unsigned __int64)Buffer + BufferSize > 0x7FFFFFFF0000i64 )
    {
      return 3221225477i64;
    }
    v10 = BytesTransferred;
    if( BytesTransferred )
    {
      v11 = (__int64)BytesTransferred;
      if( (unsigned __int64)BytesTransferred >= 0x7FFFFFFF0000i64 )
        v11 = 0x7FFFFFFF0000i64;
      *(_QWORD *)v11 = *(_QWORD *)v11;
    }
  }
  else
  {
    v10 = BytesTransferred;
  }
  v12 = 0;
  if( BufferSize )
  {
    v12 = ObReferenceObjectByHandleWithTag(
            ProcessHandle,
            VmOperation,
            (POBJECT_TYPE)PsProcessType,
            v9,
            0x6D566D4Du,
            Object,
            0i64);
    if( v12 >= 0 )
    {
      v13 = (_LIST_ENTRY *)*((_QWORD *)CurrentThread + 23);
      Object[1] = v13;
      v14 = Object[0];
      if( (*((_BYTE *)Object[0] + 992) & 1) == 0 || v13 == Object[0] || *((_QWORD *)Object[0] + 175) )
      {
        if( (_DWORD)VmOperation == 16 )
        {
          v15 = v13;
          v16 = BaseAddress;
          v17 = (_HHIVE *)Object[0];
        }
        else
        {
          v15 = (_LIST_ENTRY *)Object[0];
          v16 = Buffer;
          v17 = (_HHIVE *)v13;
        }
        v12 = MmCopyVirtualMemory(v17, (INT64)v16, v15);
      }
      else
      {
        v12 = -1073741819;
      }
      if( PsIsProcessLoggingEnabled((INT64)v14, (unsigned int)VmOperation) )
        EtwTiLogReadWriteVm((unsigned int)v12, v18, (INT64)v14, (unsigned int)VmOperation, (CHAR)BaseAddress, 0);
      ObfDereferenceObjectWithTag(v14, 0x6D566D4Dui64);
    }
  }
  if( v10 )
    *v10 = 0i64;
  return(unsigned int)v12;
}

Referenced by: