EtwpTiQueryVad

__int64 __fastcall EtwpTiQueryVad(__int64 a1, ULONG_PTR a2, PVOID *a3, unsigned int a4, char a5){
  int v8; 
  unsigned int v9; 
  unsigned int v10; 
  PVOID *v11; 
  char *v12; 
  NTSTATUS VirtualMemory; 
  void *PoolWithTag; 
  _KAPC_STATE ApcState; 
  memset(&ApcState, 0, sizeof(ApcState));
  if( a2 == *((_QWORD *)KeGetCurrentThread() + 23) )
  {
    v8 = 0;
  }
  else
  {
    KiStackAttachProcess((_KPROCESS *)a2, 0i64, &ApcState);
    v8 = 1;
  }
  v9 = 0;
  v10 = 0;
  if( a4 )
  {
    v11 = (PVOID *)(a1 + 56);
    v12 = (char *)(a1 + 8);
    do
    {
      VirtualMemory = ZwQueryVirtualMemory(
                        (PVOID)0xFFFFFFFFFFFFFFFFi64,
                        *a3,
                        MemoryBasicVlmInformation,
                        v12,
                        0x30ui64,
                        0i64);
      *((_DWORD *)v11 - 14) = VirtualMemory;
      if( VirtualMemory >= 0 )
      {
        v9 |= 1 << v10;
        if( a5 )
        {
          PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x200ui64, 0x6E734954ui64);
          *v11 = PoolWithTag;
          if( !PoolWithTag
            || ZwQueryVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, *a3, MemorySectionName, PoolWithTag, 0x200ui64, 0i64) >= 0 )
          {
            goto LABEL_9;
          }
          ExFreePoolWithTag(*v11, 0);
        }
        *v11 = 0i64;
      }
LABEL_9:
      ++v10;
      v12 += 64;
      ++a3;
      v11 += 8;
    }
    while( v10 < a4 );
  }
  if( v8 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  return v9;
}

Referenced by: