MiProtectLargeKernelHalRange

NTSTATUS __stdcall MiProtectLargeKernelHalRange(VOID *Va, VOID *a2, UINT64 SectionProtection){
  unsigned int v3; 
  NTSTATUS v6; 
  _MMPTE *PteAddress; 
  _MMPTE *PdeAddress; 
  VOID *v9; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  char v11; 
  unsigned __int64 v12; 
  int v13; 
  int v14; 
  unsigned int v15; 
  unsigned __int64 PteShadow; 
  INT64 v17; 
  UINT64 v18; 
  char WsIrql; 
  UINT64 v21; 
  _MI_TB_FLUSH_LIST TbFlushList[48]; 

  v3 = SectionProtection;
  memset(TbFlushList, 0i64, 0xB8u);
  MiInitializeTbFlushList(TbFlushList, FlushKernel, 0x14ui64);
  v6 = MiComputeDriverProtection(0i64, v3);
  PteAddress = 0i64;
  PdeAddress = MiGetPdeAddress(a2);
  AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v9);
  MiLockWorkingSetShared();
  WsIrql = v11;
  v12 = (unsigned __int64)MiGetPdeAddress(Va);
  if( v12 < (unsigned __int64)PdeAddress )
  {
    LOBYTE(v13) = MiPteInShadowRange((UINT64)&v21);
    v14 = v13;
    v15 = v6 | 0xA4000000;
    while( 1 )
    {
      if( !PteAddress )
        goto LABEL_9;
      if( (v12 & 0xFFF) == 0 )
        break;
LABEL_5:
      LODWORD(PteShadow) = MI_READ_PTE_LOCK_FREE(v12);
      v21 = PteShadow;
      if( v14 )
        PteShadow = MiReadPteShadow((__int64)&v21, PteShadow);
      LODWORD(v17) = MiMakeValidPte((_XSTATE_CONFIGURATION *)v12, (PteShadow >> 12) & 0xFFFFFFFFFi64, v15);
      MiRewritePteWithLockBit((INT64)AnyMultiplexedVm, (INT64 *)v12, v17);
      v12 += 8i64;
      if( v12 >= (unsigned __int64)PdeAddress )
        goto LABEL_8;
    }
    MiUnlockPageTable((INT64)AnyMultiplexedVm, (UINT64)PteAddress);
LABEL_9:
    PteAddress = MiGetPteAddress((VOID *)v12);
    MiLockPageTable((INT64)AnyMultiplexedVm, (UINT64)PteAddress);
    goto LABEL_5;
  }
LABEL_8:
  MiUnlockPageTable((INT64)AnyMultiplexedVm, (UINT64)PteAddress);
  LOBYTE(v18) = WsIrql;
  MiUnlockWorkingSetShared(AnyMultiplexedVm, v18);
  MiInsertTbFlushEntry(TbFlushList, Va, (unsigned __int64)((_BYTE *)a2 - (_BYTE *)Va) >> 21, 1ui64);
  MiFlushTbList(TbFlushList);
  return 0;
}

Referenced by: