sub_14065E218

__int64 __fastcall sub_14065E218(PVOID BaseAddress, unsigned int a2, int a3){
  __int64 v3; 
  __int64 v6; 
  NTSTATUS v7; 
  __int64 v8; 
  unsigned __int64 v10; 
  __int128 MemoryInformation; 
  __int64 v12; 
  __int128 v13; 
  __int128 v14; 
  __int128 v15; 
  unsigned __int64 ReturnLength; 

  v3 = a2;
  v10 = 0i64;
  ReturnLength = 0i64;
  v12 = 0i64;
  v13 = 0i64;
  v14 = 0i64;
  v15 = 0i64;
  MemoryInformation = 0i64;
  v7 = ZwQueryVirtualMemory(-1, BaseAddress, MemoryImageInformation, &MemoryInformation, 24, &ReturnLength);
  if( v7 >= 0 )
  {
    v8 = (unsigned int)v12 >> 2;
    LOBYTE(v8) = v8 & 0xF;
    if( qword_140C1D900 && (LOBYTE(v6) = 12, (unsigned int)qword_140C1D900(v8, v6)) )
    {
      v7 = 0;
      if( a3 )
      {
        v7 = ZwQueryVirtualMemory(-1, BaseAddress, MemoryBasicInformation, &v13, 48, &v10);
        if( v7 >= 0
          && ((unsigned __int64)BaseAddress < (unsigned __int64)v13
           || (unsigned __int64)BaseAddress + v3 > *((_QWORD *)&v14 + 1) + (_QWORD)v13
           || DWORD1(v15) != 32) )
        {
          return(unsigned int)-1073741811;
        }
      }
    }
    else
    {
      return(unsigned int)-1073740760;
    }
  }
  return(unsigned int)v7;
}

Referenced by:

WbCreateHeapExecutedBlock
WbDecryptWarbirdEncryptionSegmentBlockV0
WbInitializeEncryptionSegment
sub_1405D27A4
sub_140963C98
sub_140963E88