PsQueryProcessCommandLine

NTSTATUS __stdcall PsQueryProcessCommandLine(
        PVOID Process,
        _UNICODE_STRING *ProcessCommandLineBuffer,
        UINT64 ProcessCommandLineBufferLength,
        INT64 PreviousMode,
        INT64 ReturnLength){
  __int64 v7; 
  __int64 *v8; 
  __int64 v9; 
  unsigned __int64 v10; 
  unsigned __int64 v11; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  NTSTATUS v14; 
  unsigned __int64 v15; 
  unsigned int v16; 
  int v17; 
  UINT8 v19; 
  __int128 FromAddress; 
  UINT64 NumberOfBytesRead; 
  _EX_RUNDOWN_REF *RunRef; 
  __int64 v23; 
  __int64 v24; 
  _KAPC_STATE ApcState; 
  unsigned int v26; 
  CHAR v27; 

  v27 = PreviousMode;
  v26 = ProcessCommandLineBufferLength;
  memset(&ApcState, 0, sizeof(ApcState));
  NumberOfBytesRead = 0i64;
  RunRef = (_EX_RUNDOWN_REF *)((char *)Process + 1112);
  v19 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)Process + 139);
  if( v19 )
  {
    FromAddress = 0i64;
    KiStackAttachProcess(Process, 0i64, &ApcState);
    v7 = 0i64;
    v8 = (__int64 *)*((_QWORD *)Process + 176);
    if( v8 )
      v7 = *v8;
    if( v7 )
    {
      v23 = *(unsigned int *)(v7 + 16);
      v13 = *(_QWORD *)(v23 + 64);
      LODWORD(FromAddress) = v13;
      v12 = v13 >> 16;
      v11 = HIDWORD(v13);
      *((_QWORD *)&FromAddress + 1) = HIDWORD(v13);
      v14 = 0;
    }
    else
    {
      v9 = *((_QWORD *)Process + 170);
      v24 = v9;
      if( v9 )
      {
        v10 = *(_QWORD *)(v9 + 32) + 112i64;
        if( v10 >= 0x7FFFFFFF0000i64 )
          v10 = 0x7FFFFFFF0000i64;
        LODWORD(FromAddress) = *(_DWORD *)v10;
        v11 = *(_QWORD *)(v10 + 8);
        *((_QWORD *)&FromAddress + 1) = v11;
        LOWORD(v12) = HIWORD(*(_DWORD *)v10);
        LOWORD(v13) = *(_DWORD *)v10;
        v14 = 0;
      }
      else
      {
        v14 = -1073741275;
        v11 = 0i64;
        LOWORD(v12) = 0;
        LOWORD(v13) = 0;
      }
    }
    if( WORD1(FromAddress) )
    {
      if( (BYTE8(FromAddress) & 1) != 0 )
        ExRaiseDatatypeMisalignment();
      v15 = v11 + (unsigned __int16)v12;
      if( v15 > 0x7FFFFFFF0000i64 || v15 < v11 )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    KiUnstackDetachProcess(&ApcState, 0i64);
    if( v14 >= 0 )
    {
      if( !(_WORD)v13
        || (unsigned __int16)v13 > (unsigned __int16)v12
        || (FromAddress & 1) != 0
        || (BYTE2(FromAddress) & 1) != 0
        || !v11 )
      {
        v14 = -1073741275;
      }
      else
      {
        v16 = (unsigned __int16)v12 + 16;
        if( ReturnLength )
          *(_DWORD *)ReturnLength = v16;
        if( v26 < v16 )
        {
          v14 = -1073741820;
        }
        else
        {
          ProcessCommandLineBuffer->Length = v13;
          ProcessCommandLineBuffer->MaximumLength = v12;
          if( (_WORD)v12 )
            ProcessCommandLineBuffer->Buffer = &ProcessCommandLineBuffer[1].Length;
          else
            ProcessCommandLineBuffer->Buffer = 0i64;
          MmCopyVirtualMemory(
            (_EPROCESS *)Process,
            *((const VOID **)&FromAddress + 1),
            KeGetCurrentThread()->ApcState.Process,
            &ProcessCommandLineBuffer[1],
            WORD1(FromAddress),
            v27,
            &NumberOfBytesRead);
          v14 = v17;
          if( v17 >= 0 )
            v14 = 0;
        }
      }
    }
  }
  else
  {
    v14 = -1073741558;
  }
  if( v19 )
    ExReleaseRundownProtection(RunRef);
  return v14;
}

Referenced by: