MiCheckUserVirtualAddress

_MMPTE *__fastcall MiCheckUserVirtualAddress(VOID *VirtualAddress, UINT64 *ProtectCode, _MMVAD *Vad, UINT64 Flags){
  unsigned __int64 v7; 
  int v8; 
  unsigned __int64 v9; 
  _MMPTE *ProtoPteAddress; 
  char v11; 
  int v12; 
  _QWORD *v13; 
  _MMPTE *result; 
  int v15; 
  int v16; 
  INT64 ***LockedVadEvent; 
  _SUBSECTION *ContainingSubsection; 
  if( (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 1) == 0 )
  {
    v7 = (unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFFF000ui64;
    if( ((unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFFF000ui64) == 2147352576 )
    {
      result = (_MMPTE *)ProtoPte;
      *(_DWORD *)ProtectCode = 1;
      return result;
    }
    if( v7 == qword_140C4DB88 && v7 )
    {
      result = (_MMPTE *)qword_140C4DB80;
      *(_DWORD *)ProtectCode = 1;
      return result;
    }
  }
  if( (*((_DWORD *)Vad + 12) & 0x70) == 32 && (*((_DWORD *)Vad + 16) & 0x10000000) != 0 )
  {
    LockedVadEvent = MiLocateLockedVadEvent((INT64)Vad, 32i64);
    if( LockedVadEvent && LockedVadEvent[1] != (INT64 **)KeGetCurrentThread() )
      goto LABEL_25;
  }
  v8 = *((_DWORD *)Vad + 12);
  if( (v8 & 4) != 0 )
    goto LABEL_25;
  if( (v8 & 0x100000) != 0 )
  {
    v15 = *((_DWORD *)Vad + 12) & 0x70;
    if( v15 != 16 && v15 != 48 && !MiIsVadLargePrivate((INT64)Vad) && *((int *)Vad + 13) < 0 )
    {
      v16 = (*((_DWORD *)Vad + 12) >> 7) & 0x1F;
LABEL_24:
      result = 0i64;
      *(_DWORD *)ProtectCode = v16;
      return result;
    }
LABEL_25:
    v16 = 24;
    goto LABEL_24;
  }
  if( (*((_DWORD *)Vad + 16) & 0x1000000) != 0 && (*((_BYTE *)Vad + 48) & 0x70) != 80 )
    goto LABEL_25;
  v9 = (unsigned __int64)VirtualAddress >> 12;
  ProtoPteAddress = MiGetProtoPteAddress(Vad, v9, 4ui64, &ContainingSubsection);
  if( ProtoPteAddress )
  {
    v11 = *((_DWORD *)Vad + 12) & 0x70;
    v12 = (*((_DWORD *)Vad + 12) >> 7) & 0x1F;
    *(_DWORD *)ProtectCode = v12;
    if( v11 == 32 )
    {
      if( v12 == 7 )
        v12 = 256;
      *(_DWORD *)ProtectCode = v12;
    }
  }
  else
  {
    *(_DWORD *)ProtectCode = 24;
  }
  v13 = (_QWORD *)*((_QWORD *)Vad + 15);
  if( (__int64)v13 < 0
    && v9 - (*((unsigned int *)Vad + 6) | ((unsigned __int64)*((unsigned __int8 *)Vad + 32) << 32)) > (unsigned __int64)(*v13 - 1i64) >> 12 )
  {
    *(_DWORD *)ProtectCode = 24;
  }
  return ProtoPteAddress;
}

Referenced by: