#ifndef _NTPSAPI_H
//
// Reserve objects
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WINDOWS_10_20H1)

// rev
/**
 * Captures virtual address space bulk information for a process.
 *
 * \param ProcessHandle Handle to the process.
 * \param BaseAddress Optional base address to start the capture.
 * \param BulkInformation Pointer to the memory bulk information structure.
 * \param BulkInformationLength Length of the memory bulk information structure.
 * \param ReturnLength Optional pointer to a variable that receives the length of the captured information.
 * \return NTSTATUS Successful or errant status.
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtPssCaptureVaSpaceBulk(
    _In_ HANDLE ProcessHandle,
    _In_opt_ PVOID BaseAddress,
    _In_ PNTPSS_MEMORY_BULK_INFORMATION BulkInformation,
    _In_ SIZE_T BulkInformationLength,
    _Out_opt_ PSIZE_T ReturnLength
    );

#endif
#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwPssCaptureVaSpaceBulk(
    _In_ HANDLE ProcessHandle,
    _In_opt_ PVOID BaseAddress,
    _In_ PNTPSS_MEMORY_BULK_INFORMATION BulkInformation,
    _In_ SIZE_T BulkInformationLength,
    _Out_opt_ PSIZE_T ReturnLength
    );

#endif
View code on GitHub