MmGetImageInformation

__int64 __fastcall MmGetImageInformation(VOID *EndingAddress, _QWORD *a2, _QWORD *a3, int *a4){
  _ETHREAD *CurrentThread; 
  unsigned int v10; 
  int v11; 
  _EPROCESS *Process; 
  _MMVAD *v13; 

  if( (unsigned __int64)EndingAddress > 0x7FFFFFFEFFFFi64 )
    return 3221225485i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v10 = 0;
  v11 = 0;
  Process = CurrentThread->Tcb.ApcState.Process;
  if( (CurrentThread->SameThreadApcFlags & 3) == 0 )
  {
    v11 = 1;
    LOCK_ADDRESS_SPACE_SHARED(CurrentThread, CurrentThread->Tcb.ApcState.Process);
  }
  v13 = MiCheckForConflictingVad(Process, EndingAddress, EndingAddress);
  if( v13 )
  {
    if( (v13->Core.u.LongFlags & 0x70) == 32 )
    {
      *a2 = (v13->Core.StartingVpn | ((unsigned __int64)v13->Core.StartingVpnHigh << 32)) << 12;
      *a3 = ((v13->Core.EndingVpn | ((unsigned __int64)v13->Core.EndingVpnHigh << 32))
           - (v13->Core.StartingVpn | ((unsigned __int64)v13->Core.StartingVpnHigh << 32))
           + 1) << 12;
      *a4 = *((_DWORD *)&v13->Subsection->ControlArea->Segment->u2.ImageInformation->InternalImageInformation + 3) & 1;
    }
    else
    {
      v10 = -1073741751;
    }
  }
  else
  {
    v10 = -1073741800;
  }
  if( v11 == 1 )
    UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
  return v10;
}

Referenced by: