VslDebugReadWriteSecureProcess

NTSTATUS __fastcall VslDebugReadWriteSecureProcess(
        __int64 a1,
        __int64 a2,
        INT64 a3,
        unsigned __int64 a4,
        unsigned __int8 a5,
        _QWORD *a6){
  __int64 v8; 
  _BOOL4 v10; 
  unsigned int v11; 
  NTSTATUS result; 
  INT64 v13; 
  NTSTATUS v14; 
  INT64 v16[10]; 
  INT64 v17[14]; 

  v8 = a1;
  memset(v17, 0i64, 0x68u);
  memset(v16, 0i64, 0x48u);
  *a6 = 0i64;
  v10 = a5 != 0;
  if( !a4 )
    return 0;
  while( 1 )
  {
    v11 = a4;
    if( 2072576 - (unsigned int)(a3 & 0xFFF) <= a4 )
      v11 = 2072576 - (a3 & 0xFFF);
    result = VslpLockPagesForTransfer((INT64)v16, a3, v11, v10, 0);
    if( result < 0 )
      break;
    v13 = *(_QWORD *)(v8 + 992);
    v17[6] = 0i64;
    v17[1] = v13;
    v17[3] = a5;
    v17[4] = v16[0];
    v17[5] = v16[7];
    v17[2] = a2;
    v14 = VslpEnterIumSecureMode(2u, 39, 0i64, (INT64)v17);
    VslpUnlockPagesForTransfer((INT64 **)v16);
    *a6 += v17[6];
    if( v14 < 0 )
      return v14;
    v10 = a5 != 0;
    v8 = a1;
    a2 += v11;
    a3 += v11;
    a4 -= v11;
    if( !a4 )
      return 0;
  }
  return result;
}

Referenced by:

MmCopyVirtualMemory