MiAllowProtectionChange

INT64 __fastcall MiAllowProtectionChange(
        _EPROCESS *Process,
        _EPROCESS *CreatingProcess,
        _MMVAD *Vad,
        UINT64 NewProtectionMask,
        VOID *StartingAddress,
        VOID *EndingAddress){
  unsigned int v6; 
  char v7; 
  int v10; 
  unsigned __int8 v11; 
  unsigned __int64 v12; 
  int v13; 
  __int16 v15[2]; 
  int v16; 
  int v17; 
  int v18; 
  unsigned __int64 v19; 
  v6 = 0;
  v7 = NewProtectionMask;
  v19 = 0i64;
  v18 = 0;
  v16 = 0;
  v17 = 0;
  v15[0] = 0;
  if( (NewProtectionMask & 2) != 0 && (*((_DWORD *)Vad + 12) & 0xC00) == 3072 && (*((_DWORD *)Vad + 12) & 0x380) != 0 )
    return 3221225541i64;
  v10 = 0;
  v11 = MiLockWorkingSetShared((INT64)Process + 1664);
  v12 = (unsigned __int64)StartingAddress;
  if( StartingAddress <= EndingAddress )
  {
    while( 1 )
    {
      MiQueryAddressState(v12, (unsigned __int64)EndingAddress, v11, (ULONG_PTR)Vad, 0i64, &v16, &v18, v15, &v19, &v17);
      v13 = v16;
      if( v16 == -1 )
        v13 = 0;
      v16 = v13;
      if( (v13 & 2) == 0 && (v7 & 2) != 0 || (v13 & 2) != 0 && (v7 & 4) != 0 )
        break;
      v12 = v19;
      if( v19 > (unsigned __int64)EndingAddress )
        goto LABEL_11;
    }
    v10 = 1;
  }
LABEL_11:
  MiUnlockWorkingSetShared((INT64)Process + 1664, v11);
  if( v10 )
    return(unsigned int)MiArbitraryCodeBlocked((__int64)CreatingProcess);
  return v6;
}

Referenced by: