VslDebugReadWriteSecureProcess
NTSTATUS __fastcall VslDebugReadWriteSecureProcess(
__int64 a1,
__int64 a2,
INT64 a3,
unsigned __int64 a4,
unsigned __int8 a5,
_QWORD *a6){
__int64 v8;
_BOOL4 v10;
unsigned int v11;
NTSTATUS result;
INT64 v13;
NTSTATUS v14;
INT64 v16[10];
INT64 v17[14];
v8 = a1;
memset(v17, 0i64, 0x68u);
memset(v16, 0i64, 0x48u);
*a6 = 0i64;
v10 = a5 != 0;
if( !a4 )
return 0;
while( 1 )
{
v11 = a4;
if( 2072576 - (unsigned int)(a3 & 0xFFF) <= a4 )
v11 = 2072576 - (a3 & 0xFFF);
result = VslpLockPagesForTransfer((INT64)v16, a3, v11, v10, 0);
if( result < 0 )
break;
v13 = *(_QWORD *)(v8 + 992);
v17[6] = 0i64;
v17[1] = v13;
v17[3] = a5;
v17[4] = v16[0];
v17[5] = v16[7];
v17[2] = a2;
v14 = VslpEnterIumSecureMode(2u, 39, 0i64, (INT64)v17);
VslpUnlockPagesForTransfer((INT64 **)v16);
*a6 += v17[6];
if( v14 < 0 )
return v14;
v10 = a5 != 0;
v8 = a1;
a2 += v11;
a3 += v11;
a4 -= v11;
if( !a4 )
return 0;
}
return result;
}Referenced by:
MmCopyVirtualMemory