MiCanGrantExecute
_BOOL8 __fastcall MiCanGrantExecute(__int64 a1, unsigned __int64 a2){
__int64 v2;
char v4;
RTL_BALANCED_NODE *Address;
int v6;
_BOOL8 result;
v2 = *(_QWORD *)(a1 + 1408);
result = 0;
if( v2 )
{
if( *(_WORD *)(v2 + 8) == 332 )
{
if( (KeFeatureBits & 0x40000000) != 0
|| (v4 = *(_BYTE *)(a1 + 643), (v4 & 2) != 0)
|| (KeFeatureBits & 0x80000000) == 0 && (v4 & 1) == 0 )
{
if( (a2 & 0xFFFFFFFFFFFFF000ui64) == 2147352576 && (*(_DWORD *)(a1 + 2172) & 1) == 0 )
return 1;
Address = MiLocateAddress(a2);
if( Address )
{
v6 = (int)Address[2].Children[0];
if( (v6 & 0x70) != 48 && ((v6 & 0x70) != 32 || (v6 & 0xF80) != 128) )
return 1;
}
}
}
}
return result;
}Referenced by:
MiLargePageFault
MiValidFault