PfpMemoryListQuery

NTSTATUS __stdcall PfpMemoryListQuery(_SUPERFETCH_INFORMATION *Info, INT8 PreviousMode, UINT64 *OutSize){
  NTSTATUS v6; 
  __int64 v7; 
  UINT64 SystemInformationLength[22]; 

  memset(SystemInformationLength, 0i64, sizeof(SystemInformationLength));
  v6 = 0;
  if( (unsigned int)Info[6] < 0x40 )
  {
    v6 = -1073741789;
  }
  else
  {
    MmQueryMemoryListInformation((VOID *)0xFFFFFFFFFFFFFFFFi64, (UINT64)SystemInformationLength, (UINT64 *)0xB0);
    v7 = *((_QWORD *)Info + 2);
    if( PreviousMode )
      ProbeForWrite(*((_QWORD *)Info + 2), (unsigned int)Info[6], 8i64);
    *(_DWORD *)v7 = 1;
    *(_DWORD *)(v7 + 4) = 64;
    *(_DWORD *)(v7 + 8) = 1;
    *(_QWORD *)(v7 + 16) &= 0xFFFFFFFFFFFFFF00ui64;
    *(_QWORD *)(v7 + 24) = SystemInformationLength[8]
                         + SystemInformationLength[7]
                         + SystemInformationLength[6]
                         + SystemInformationLength[5]
                         + SystemInformationLength[9];
    *(_QWORD *)(v7 + 32) = SystemInformationLength[10];
    *(_QWORD *)(v7 + 40) = SystemInformationLength[12] + SystemInformationLength[11];
    *(_QWORD *)(v7 + 48) = SystemInformationLength[0] + SystemInformationLength[1];
    *(_QWORD *)(v7 + 56) = SystemInformationLength[3] + SystemInformationLength[2];
  }
  *(_DWORD *)OutSize = 64;
  return v6;
}

Referenced by: