MiCheckProtoAccess

INT64 __fastcall MiCheckProtoAccess(INT64 a1, _DWORD *a2){
  unsigned __int64 v4; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  INT64 v8; 
  INT64 result; 
  UINT64 ProtectCode; 
  _MMVAD *VadOut; 
  VadOut = 0i64;
  LODWORD(ProtectCode) = 0;
  v4 = MI_READ_PTE_LOCK_FREE(a1);
  v5 = (v4 >> 5) & 0x1F;
  if( MiIsPrototypePteVadLookup(v4) )
  {
    v8 = (INT64)MiCheckVirtualAddress(
                  (VOID *)(((a1 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16),
                  &ProtectCode,
                  &VadOut);
  }
  else
  {
    v7 = v6;
    if( qword_140C4DC80 )
    {
      if( (v6 & 0x10) != 0 )
        v7 = v6 & 0xFFFFFFFFFFFFFFEFui64;
      else
        v7 = v6 & ~qword_140C4DC80;
    }
    v8 = v7 >> 16;
    LODWORD(v5) = (v6 & 8) != 0 ? 1 : 256;
  }
  result = v8;
  *a2 = v5;
  return result;
}

Referenced by: