NtPssCaptureVaSpaceBulk

NTSTATUS __stdcall NtPssCaptureVaSpaceBulk(INT64 a1){
  unsigned __int64 v1; 
  __int64 v2; 
  unsigned __int64 v3; 
  unsigned int v4; 
  __int128 *v5; 
  int v6; 
  INT64 v7; 
  int v8; 
  INT8 PreviousMode; 
  __int64 v11; 
  _MDL *Mdl; 
  _QWORD *v13; 
  _IRP *Irp; 
  UINT64 Priority; 
  PVOID BaseAddress; 
  __int64 v17; 
  unsigned __int64 Handlea; 
  UINT64 Length; 
  PVOID Object; 
  unsigned __int64 ReturnLength; 
  __int128 v23; 
  INT64 v24; 
  unsigned __int64 v25; 
  __int64 v26; 
  unsigned __int64 v27; 
  _ETHREAD *CurrentThread; 
  _KAPC_STATE ApcState; 
  __int64 *v30; 

  v4 = v3;
  Length = v3;
  v5 = (__int128 *)v2;
  BaseAddress = (PVOID)v1;
  v24 = a1;
  v25 = v1;
  v26 = v2;
  v27 = v3;
  Object = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  ReturnLength = 0i64;
  v17 = 0i64;
  v6 = 0;
  v7 = 0i64;
  v8 = 0;
  if( v3 < 0x10 )
    return -1073741820;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  if( PreviousMode )
  {
    v23 = 0i64;
    ProbeForWrite(v2, v3, 8i64);
    if( v30 )
    {
      v11 = (__int64)v30;
      v2 = 0x7FFFFFFF0000i64;
      if( (unsigned __int64)v30 >= 0x7FFFFFFF0000i64 )
        v11 = 0x7FFFFFFF0000i64;
      *(_QWORD *)v11 = *(_QWORD *)v11;
    }
    v23 = *v5;
    v1 = (unsigned __int64)BaseAddress;
    v4 = Length;
  }
  else
  {
    v23 = *(_OWORD *)v2;
  }
  if( (_DWORD)v23 )
  {
    if( (v23 & 0xFFFFFFFC) != 0 )
    {
      v8 = -1073741637;
    }
    else
    {
      if( v1 <= 0x7FFFFFFEFFFFi64 )
      {
        if( PreviousMode )
        {
          Mdl = IoAllocateMdl(v5, v4, 0, 0, 0i64);
          v7 = (INT64)Mdl;
          if( !Mdl
            || ((MmProbeAndLockPages(Mdl, 0, IoWriteAccess), (*(_BYTE *)(v7 + 10) & 5) == 0) ? (LODWORD(Priority) = 1073741840,
                                                                                                LODWORD(Irp) = 0,
                                                                                                v5 = (__int128 *)MmMapLockedPagesSpecifyCache((_MDL *)v7, 0, MmCached, 0i64, (UINT64)Irp, Priority)) : (v5 = *(__int128 **)(v7 + 24)),
                !v5) )
          {
            v8 = -1073741670;
            goto LABEL_44;
          }
        }
        else
        {
          v7 = 0i64;
        }
        if( a1 != -1 )
        {
          LODWORD(Irp) = 1098085200;
          v8 = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 PreviousMode,
                 (UINT64)Irp,
                 &Object,
                 0i64);
          if( v8 < 0 )
            goto LABEL_44;
          if( (*((_DWORD *)Object + 543) & 0x1000) != 0 )
          {
            ObfDereferenceObjectWithTag(Object, 0x41737350ui64);
            v8 = -1073741790;
            goto LABEL_44;
          }
          KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
          v6 = 1;
        }
        if( PreviousMode )
        {
          v8 = ZwPssCaptureVaSpaceBulk(-1i64);
        }
        else
        {
          *((_DWORD *)v5 + 1) = 0;
          v17 = 16i64;
          Handlea = Length - 16;
          v13 = v5 + 1;
          if( Length - 16 >= 0x30 )
          {
            while( 1 )
            {
              if( (CurrentThread->CrossThreadFlags & 1) != 0 )
              {
                v8 = -1073741749;
                goto LABEL_44;
              }
              v8 = NtQueryVirtualMemory(-1, BaseAddress, MemoryBasicInformation, v13, 48, &ReturnLength);
              if( v8 < 0 )
                break;
              Handlea -= ReturnLength;
              v17 += ReturnLength;
              BaseAddress = (PVOID)(*v13 + v13[3]);
              v13 += 6;
              ++*((_DWORD *)v5 + 1);
              *((_QWORD *)v5 + 1) = BaseAddress;
              if( Handlea < 0x30 )
                goto LABEL_41;
            }
            if( *((_DWORD *)v5 + 1) )
              v8 = 0;
          }
LABEL_41:
          if( v8 >= 0 && *((_QWORD *)v5 + 1) != 0x7FFFFFFF0000i64 )
            v8 = 261;
        }
        goto LABEL_44;
      }
      v8 = -1073741503;
    }
  }
  else
  {
    v8 = -1073741811;
  }
LABEL_44:
  if( v6 )
    KeUnstackDetachProcess(&ApcState);
  if( v7 )
  {
    MmUnlockPages(v7, v1, v2);
    IoFreeMdl((PMDL)v7);
  }
  if( v30 )
    *v30 = v17;
  return v8;
}

Referenced by: