NtQueryInformationAtom

INT64 __fastcall NtQueryInformationAtom(UINT16 a1, INT64 a2, UINT16 *a3, UINT64 a4, INT64 *ReturnLength){
  unsigned int v5; 
  int v7; 
  __int64 v9; 
  int v10; 
  int AtomsInAtomTable; 
  int v12; 
  UINT64 RefCount; 
  int v15; 
  UINT64 PinCount; 
  PRTL_ATOM_TABLE AtomTable; 
  _ETHREAD *CurrentThread; 
  v5 = a4;
  v7 = a2;
  LODWORD(PinCount) = 0;
  AtomTable = 0i64;
  RefCount = 0i64;
  PsInvokeWin32Callout(2i64, &AtomTable, 0i64, 0i64);
  if( !AtomTable )
    return 3221225506i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( *((_BYTE *)CurrentThread + 562) )
  {
    ProbeForWrite(a3, v5, 4ui64);
    if( ReturnLength )
    {
      v9 = 0x7FFFFFFF0000i64;
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v9 = (__int64)ReturnLength;
      *(_DWORD *)v9 = *(_DWORD *)v9;
    }
  }
  v10 = 0;
  if( v7 )
  {
    if( v7 == 1 )
    {
      v10 = 4;
      if( v5 < 4 )
        return 3221225476i64;
      AtomsInAtomTable = RtlQueryAtomsInAtomTable(AtomTable, (v5 - 4) >> 1, (UINT64 *)a3, a3 + 2);
      v15 = AtomsInAtomTable;
      if( AtomsInAtomTable >= 0 )
        v10 = 2 * *(_DWORD *)a3 + 4;
    }
    else
    {
      AtomsInAtomTable = -1073741821;
      v15 = -1073741821;
    }
  }
  else
  {
    v10 = 6;
    if( v5 < 6 )
      return 3221225476i64;
    LODWORD(RefCount) = 0;
    HIDWORD(RefCount) = v5 - 6;
    AtomsInAtomTable = RtlQueryAtomInAtomTable(
                         AtomTable,
                         a1,
                         &RefCount,
                         &PinCount,
                         a3 + 3,
                         (UINT64 *)((char *)&RefCount + 4));
    v15 = AtomsInAtomTable;
    if( AtomsInAtomTable >= 0 )
    {
      *a3 = RefCount;
      a3[1] = PinCount;
      v12 = HIDWORD(RefCount);
      a3[2] = WORD2(RefCount);
      v10 = v12 + 8;
    }
  }
  if( ReturnLength )
    *(_DWORD *)ReturnLength = v10;
  return(unsigned int)AtomsInAtomTable;
}

Referenced by: