PfpVirtualQuery

NTSTATUS __fastcall PfpVirtualQuery(INT64 a1, CHAR a2, _DWORD *a3){
  unsigned int v4; 
  unsigned __int64 v5; 
  int v6; 
  NTSTATUS result; 
  UINT64 Flags; 
  UINT8 dst[16]; 
  HANDLE Handle[2]; 
  *(_OWORD *)dst = 0i64;
  *(_OWORD *)Handle = 0i64;
  if( *(_DWORD *)(a1 + 24) != 32 )
    return -1073741306;
  v4 = 32;
  if( a2 )
  {
    v5 = *(_QWORD *)(a1 + 16);
    if( (v5 & 7) != 0 )
      ExRaiseDatatypeMisalignment();
    if( v5 + 32 > 0x7FFFFFFF0000i64 || (v4 = 32, v5 + 32 < v5) )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
      v4 = *(_DWORD *)(a1 + 24);
    }
  }
  memmove(dst, *(UINT8 **)(a1 + 16), v4);
  if( *(_DWORD *)dst != 1 )
    return -1073741811;
  v6 = 2;
  if( (dst[4] & 1) != 0 && (dst[4] & 2) != 0 )
    return -1073741811;
  if( (*(_DWORD *)&dst[4] & 0xFFFFFFFC) != 0 )
    return -1073741811;
  if( (dst[4] & 1) == 0 )
    v6 = (dst[4] & 2) != 0;
  LODWORD(Flags) = v6;
  result = MmQueryVirtualMemory(
             Handle[1],
             0i64,
             MemoryWorkingSetExList,
             *(PVOID *)&dst[8],
             (UINT64)Handle[0],
             0i64,
             Flags);
  if( result >= 0 )
    *a3 = 32;
  return result;
}

Referenced by: