ExQueryPoolBlockSize

NTSTATUS __fastcall ExQueryPoolBlockSize(UINT64 a1, BOOL *a2){
  UINT64 v4; 
  NTSTATUS result; 
  _DWORD *v6; 
  _POOL_HEADER *v7; 
  int v8; 
  bool v9; 

  LODWORD(v4) = ExGetHeapFromVA((PVOID)a1);
  if( ExpHpIsSpecialPoolHeap(v4) )
  {
    *a2 = 0;
    v6 = (_DWORD *)(a1 & 0xFFFFFFFFFFFFF000ui64);
    if( (a1 & 0xFFF) == 0 )
      v6 = (_DWORD *)((a1 & 0xFFFFFFFFFFFFF000ui64) + 4080);
    return *v6 & 0xFFF;
  }
  else if( (a1 & 0xFFF) != 0 )
  {
    v7 = (_POOL_HEADER *)(a1 - 16);
    v8 = 16 * (unsigned __int8)*(_WORD *)(a1 - 16 + 2);
    v9 = ExpGetBilledProcess(v7) == 0i64;
    result = v8 - 16;
    *a2 = !v9;
  }
  else
  {
    *a2 = 0;
    return 4096;
  }
  return result;
}

Referenced by: