VfZwQueryInformationProcess

NTSTATUS __stdcall VfZwQueryInformationProcess(
        VOID *ProcessHandle,
        PROCESSINFOCLASS ProcessInformationClass,
        VOID *ProcessInformation,
        UINT64 ProcessInformationLength,
        ULONG_PTR ReturnLength){
  unsigned int v5; 
  UINT64 v9; 
  VOID *retaddr; 

  v5 = ProcessInformationLength;
  if( (unsigned int)ViZwShouldCheck() )
  {
    ViZwCheckVirtualAddress(v9, retaddr);
    ViZwCheckVirtualAddress(*(UINT64 *)&ReturnLength, retaddr);
  }
  return((__int64(__fastcall *)(VOID *, _QWORD, VOID *, _QWORD, _QWORD))pXdvZwQueryInformationProcess)(
           ProcessHandle,
           (unsigned int)ProcessInformationClass,
           ProcessInformation,
           v5,
           *(_QWORD *)&ReturnLength);
}

Referenced by: