NtFlushVirtualMemory

NTSTATUS __stdcall NtFlushVirtualMemory(
        PVOID ProcessHandle,
        PVOID *BaseAddress,
        UINT64 *RegionSize,
        _IO_STATUS_BLOCK *IoStatus){
  KPROCESSOR_MODE v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  PVOID v12; 
  UINT64 v13; 
  NTSTATUS result; 
  NTSTATUS v15; 
  UINT64 v16; 
  unsigned __int64 v17; 
  PVOID Object; 
  _IO_STATUS_BLOCK v19; 
  Object = 0i64;
  v17 = 0i64;
  v16 = 0i64;
  v19 = 0i64;
  v8 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v8 )
  {
    v9 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)BaseAddress < 0x7FFFFFFF0000i64 )
      v9 = (__int64)BaseAddress;
    *(_QWORD *)v9 = *(_QWORD *)v9;
    v10 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)RegionSize < 0x7FFFFFFF0000i64 )
      v10 = (__int64)RegionSize;
    *(_QWORD *)v10 = *(_QWORD *)v10;
    v11 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)IoStatus < 0x7FFFFFFF0000i64 )
      v11 = (__int64)IoStatus;
    *(_DWORD *)v11 = *(_DWORD *)v11;
    v12 = *BaseAddress;
    v17 = (unsigned __int64)*BaseAddress;
    v13 = *RegionSize;
    v16 = *RegionSize;
  }
  else
  {
    v12 = *BaseAddress;
    v17 = (unsigned __int64)*BaseAddress;
    v13 = *RegionSize;
    v16 = *RegionSize;
  }
  if( (unsigned __int64)v12 > 0x7FFFFFFEFFFFi64 )
    return -1073741584;
  if( 0x7FFFFFFF0000i64 - (__int64)v12 < v13 )
    return -1073741583;
  result = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             8u,
             (POBJECT_TYPE)PsProcessType,
             v8,
             0x6C466D4Du,
             &Object,
             0i64);
  if( result >= 0 )
  {
    v15 = MmFlushVirtualMemory((ULONG_PTR)Object, &v17, &v16, &v19);
    ObfDereferenceObjectWithTag(Object, 0x6C466D4Dui64);
    *RegionSize = v16;
    *BaseAddress = (PVOID)(v17 & 0xFFFFFFFFFFFFF000ui64);
    *IoStatus = v19;
    return v15;
  }
  return result;
}

Referenced by: