MiReadWriteVirtualMemory

VOID __fastcall MiReadWriteVirtualMemory(VOID *ProcessHandle, VOID *BaseAddress, VOID *Buffer, UINT64 BufferSize){
  UINT64 v7; 
  _ETHREAD *CurrentThread; 
  INT8 PreviousMode; 
  _QWORD *v10; 
  __int64 v11; 
  _EPROCESS *Process; 
  INT64 *v13; 
  VOID *v14; 
  _EPROCESS *v15; 
  VOID *v16; 
  _EPROCESS *v17; 
  unsigned int v18; 
  unsigned int v19; 
  INT64 v20; 
  int v21; 
  UINT64 Tag; 
  CHAR v23; 
  UINT64 NumberOfBytesRead; 
  PVOID Object[2]; 
  unsigned __int64 v27; 
  unsigned int DesiredAccess; 

  v7 = 0i64;
  Object[0] = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  v23 = PreviousMode;
  if( PreviousMode )
  {
    if( (char *)BaseAddress + BufferSize < BaseAddress
      || (unsigned __int64)BaseAddress + BufferSize > 0x7FFFFFFF0000i64
      || (char *)Buffer + BufferSize < Buffer
      || (unsigned __int64)Buffer + BufferSize > 0x7FFFFFFF0000i64 )
    {
      return;
    }
    v10 = (_QWORD *)v27;
    if( v27 )
    {
      v11 = v27;
      if( v27 >= 0x7FFFFFFF0000i64 )
        v11 = 0x7FFFFFFF0000i64;
      *(_QWORD *)v11 = *(_QWORD *)v11;
    }
  }
  else
  {
    v10 = (_QWORD *)v27;
  }
  NumberOfBytesRead = 0i64;
  if( BufferSize )
  {
    LODWORD(Tag) = 1834380621;
    if( ObReferenceObjectByHandleWithTag(
           ProcessHandle,
           DesiredAccess,
           (_OBJECT_TYPE *)PsProcessType,
           PreviousMode,
           Tag,
           Object,
           0i64) >= 0 )
    {
      Process = CurrentThread->Tcb.ApcState.Process;
      Object[1] = Process;
      v13 = (INT64 *)Object[0];
      if( (*((_BYTE *)Object[0] + 992) & 1) == 0 || Process == Object[0] || *((_QWORD *)Object[0] + 175) )
      {
        if( DesiredAccess == 16 )
        {
          v14 = Buffer;
          v15 = Process;
          v16 = BaseAddress;
          v17 = (_EPROCESS *)Object[0];
        }
        else
        {
          v14 = BaseAddress;
          v15 = (_EPROCESS *)Object[0];
          v16 = Buffer;
          v17 = Process;
        }
        MmCopyVirtualMemory(v17, v16, v15, v14, BufferSize, v23, &NumberOfBytesRead);
        v7 = NumberOfBytesRead;
        v19 = v18;
      }
      else
      {
        v19 = -1073741819;
      }
      PsIsProcessLoggingEnabled(v13, DesiredAccess);
      if( v21 )
        EtwTiLogReadWriteVm(v19, v20, (INT64)v13, DesiredAccess, (CHAR)BaseAddress, v7);
      ObfDereferenceObjectWithTag(v13, 0x6D566D4Dui64);
    }
  }
  if( v10 )
    *v10 = v7;
}

Referenced by: