VslDebugReadWriteSecureProcess
INT64 __fastcall VslDebugReadWriteSecureProcess(INT64 a1, INT64 a2, INT64 a3, UINT64 a4, UINT8 a5, _QWORD *a6){
INT64 v8;
_BOOL8 v10;
unsigned int v11;
INT64 v12;
INT64 v13;
NTSTATUS v14;
INT64 v16[10];
INT64 result[6];
__int64 v18;
v8 = a1;
memset((INT64)result, 0i64);
memset((INT64)v16, 0i64);
*a6 = 0i64;
v10 = a5 != 0;
if( !a4 )
return 0i64;
while( 1 )
{
v11 = a4;
if( 2072576 - (unsigned int)(a3 & 0xFFF) <= a4 )
v11 = 2072576 - (a3 & 0xFFF);
v12 = VslpLockPagesForTransfer((INT64)v16, a3, v11, v10, 0);
if( (int)v12 < 0 )
break;
v13 = *(_QWORD *)(v8 + 992);
v18 = 0i64;
result[1] = v13;
result[3] = a5;
result[4] = v16[0];
result[5] = v16[7];
result[2] = a2;
v14 = VslpEnterIumSecureMode(2u, 39, 0i64, (INT64)result);
VslpUnlockPagesForTransfer((INT64 **)v16);
*a6 += v18;
if( v14 < 0 )
return(unsigned int)v14;
LODWORD(v10) = a5 != 0;
v8 = a1;
a2 += v11;
a3 += v11;
a4 -= v11;
if( !a4 )
return 0i64;
}
return v12;
}Referenced by:
MmCopyVirtualMemory