MmCheckForSafeExecution

UINT8 __stdcall MmCheckForSafeExecution(
        PVOID InstructionPointer,
        PVOID StackPointer,
        PVOID BranchTarget,
        UINT8 PermitStackExecution){
  _ETHREAD *CurrentThread; 
  UINT8 v9; 
  _EPROCESS *v10; 
  RTL_BALANCED_NODE *Address; 
  __int64 v12; 
  RTL_BALANCED_NODE *v13; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v9 = 1;
  v10 = (_EPROCESS *)*((_QWORD *)CurrentThread + 23);
  LOCK_ADDRESS_SPACE_SHARED(CurrentThread, v10);
  if( !PermitStackExecution
    && ((MiLocateAddress((UINT64)InstructionPointer), Address = MiLocateAddress((UINT64)StackPointer), !v12)
     || !Address
     || (RTL_BALANCED_NODE *)v12 == Address
     || (*(_DWORD *)(v12 + 48) & 0x70) == 32)
    || (v13 = MiLocateAddress((UINT64)BranchTarget)) == 0i64
    || ((__int64)v13[2].Children[0] & 0x70) != 32 )
  {
    v9 = 0;
  }
  UNLOCK_ADDRESS_SPACE_SHARED((__int64)CurrentThread, (__int64)v10);
  if( v9 == 1 )
    return(unsigned int)MmValidateUserCallTarget(BranchTarget, 1ui64) != 0;
  return v9;
}

Referenced by: