MiIsAddressInDriverView

INT64 __fastcall MiIsAddressInDriverView(UINT64 a1){
  INT64 v1; 
  INT64 v2; 
  unsigned int v4; 
  UINT64 v5; 
  PVOID *i; 
  UINT8 OldIrql; 
  v4 = 0;
  OldIrql = 0;
  MmLockLoadedModuleListShared(&OldIrql, v1, v2);
  for( i = (PVOID *)PsLoadedModuleList; i != &PsLoadedModuleList; i = (PVOID *)*i )
  {
    v5 = (UINT64)i[6];
    if( a1 >= v5 && a1 < v5 + *((unsigned int *)i + 16) )
    {
      v4 = 1;
      break;
    }
  }
  LOBYTE(v5) = OldIrql;
  MmUnlockLoadedModuleListShared(v5);
  return v4;
}

Referenced by: