RtlQueryModuleInformation

NTSTATUS __stdcall RtlQueryModuleInformation(
        UINT64 *BufferSize,
        UINT64 ElementSize,
        VOID *QueryInfo,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  int v9; 
  unsigned int v11; 
  NTSTATUS result; 
  char *PoolWithQuotaTag; 
  int v14; 
  NTSTATUS v15; 
  unsigned int v16; 
  __int64 v17; 
  char *v18; 
  __int64 v19; 
  _OWORD *v20; 
  __int64 v21; 
  char *v22; 
  __int128 v23; 
  char P[304]; 

  v9 = ElementSize;
  memset(P, 0i64, sizeof(P));
  v11 = 0;
  if( v9 == 272 )
  {
    result = ((unsigned __int8)QueryInfo & 7) != 0 ? 0xC00000F1 : 0;
    goto LABEL_3;
  }
  if( v9 != 8 )
    return -1073741584;
  if( ((unsigned __int8)QueryInfo & 7) != 0 )
  {
    result = -1073741583;
LABEL_3:
    if( result < 0 )
      return result;
  }
  PoolWithQuotaTag = P;
  while( 1 )
  {
    ZwQuerySystemInformation();
    v15 = v14;
    if( ((v14 + 0x80000000) & 0x80000000) == 0 && v14 != -1073741820 )
      break;
    if( !QueryInfo )
    {
      v15 = 0;
      v16 = 14510024 * v9;
LABEL_14:
      *(_DWORD *)BufferSize = v16;
      break;
    }
    if( v14 >= 0 )
    {
      v16 = v9 * *(_DWORD *)PoolWithQuotaTag;
      if( *(_DWORD *)BufferSize < v16 )
      {
        v15 = -1073741789;
      }
      else if( *(_DWORD *)PoolWithQuotaTag )
      {
        do
        {
          if( v9 == 8 )
          {
            *((_QWORD *)QueryInfo + v11) = *(_QWORD *)&PoolWithQuotaTag[296 * v11 + 24];
          }
          else
          {
            v17 = 296i64 * v11;
            v18 = (char *)QueryInfo + 272 * v11;
            *(_QWORD *)v18 = *(_QWORD *)&PoolWithQuotaTag[v17 + 24];
            *((_DWORD *)v18 + 2) = *(_DWORD *)&PoolWithQuotaTag[v17 + 32];
            *((_WORD *)v18 + 6) = *(_WORD *)&PoolWithQuotaTag[v17 + 46];
            v19 = v17 + 48;
            v20 = v18 + 14;
            v21 = 2i64;
            v22 = &PoolWithQuotaTag[v19];
            do
            {
              *v20 = *(_OWORD *)v22;
              v20[1] = *((_OWORD *)v22 + 1);
              v20[2] = *((_OWORD *)v22 + 2);
              v20[3] = *((_OWORD *)v22 + 3);
              v20[4] = *((_OWORD *)v22 + 4);
              v20[5] = *((_OWORD *)v22 + 5);
              v20[6] = *((_OWORD *)v22 + 6);
              v20 += 8;
              v23 = *((_OWORD *)v22 + 7);
              v22 += 128;
              *(v20 - 1) = v23;
              --v21;
            }
            while( v21 );
          }
          ++v11;
        }
        while( v11 < *(_DWORD *)PoolWithQuotaTag );
      }
      goto LABEL_14;
    }
    if( PoolWithQuotaTag != P )
      ExFreePoolWithTag(PoolWithQuotaTag, 0);
    PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, 0i64, 0x546C7452ui64);
    if( !PoolWithQuotaTag )
      return -1073741670;
  }
  if( PoolWithQuotaTag != P )
    ExFreePoolWithTag(PoolWithQuotaTag, 0);
  return v15;
}

Referenced by: