MiIsDriverPage
_QWORD *__fastcall MiIsDriverPage(INT64 a1){
INT64 v1;
INT64 v2;
unsigned __int64 v3;
_QWORD *v4;
unsigned __int64 v5;
_QWORD *v6;
UINT8 OldIrql;
OldIrql = 17;
v3 = ((a1 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
MmLockLoadedModuleListShared(&OldIrql, v1, v2);
v4 = (_QWORD *)qword_140C4CAA0;
if( qword_140C4CAA0 )
{
do
{
v5 = *(v4 - 23);
if( v3 > v5 + (unsigned int)(*((_DWORD *)v4 - 42) - 1) )
{
v4 = (_QWORD *)v4[1];
}
else
{
if( v3 >= v5 )
break;
v4 = (_QWORD *)*v4;
}
}
while( v4 );
}
v6 = v4 - 29;
if( !v4 )
v6 = 0i64;
MmUnlockLoadedModuleListShared(OldIrql);
return v6;
}Referenced by:
MiAddWorkingSetEntries
MiProbeLeafPteAccess
MiRemoveWsleList