MmSecureVirtualMemoryEx

__int64 __fastcall MmSecureVirtualMemoryEx(unsigned __int64 a1, __int64 a2, int a3, int a4){
  unsigned __int64 v8; 
  INT64 v9; 
  _MMVAD_SHORT *v10; 
  unsigned int v11; 
  unsigned int v12; 
  UINT64 v13; 
  NTSTATUS v14; 
  _MI_VAD_EVENT_BLOCK **SecureHandle; 
  INT64 v17; 
  if( (a4 & 0xFFFFFFF0) == 0 )
  {
    v8 = a1 + a2;
    if( a1 + a2 > a1
      && v8 <= 0x7FFFFFFF0000i64
      && ((unsigned int)(a3 - 1) <= 1 || a3 == 4 || a3 == -2147483647)
      && a3 >= 0 )
    {
      v9 = MiObtainReferencedVadEx(a1 & 0xFFFFFFFFFFFFF000ui64, 0, &v17);
      v10 = (_MMVAD_SHORT *)v9;
      if( v9 )
      {
        if( (v8 - 1) >> 12 > (*(unsigned int *)(v9 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v9 + 33) << 32))
          || (v11 = *(_DWORD *)(v9 + 48), (*(_BYTE *)(v9 + 48) & 0x70) == 48)
          || (v11 & 0x100000) != 0 && ((v12 = (v11 >> 18) & 3, (v11 & 0x400000) != 0) || v12 >= 2) && v12 >= 2 )
        {
          MiUnlockAndDereferenceVad(v10);
        }
        else
        {
          v13 = (unsigned int)a3;
          LODWORD(v13) = a3 | 0x80000000;
          if( (a4 & 2) == 0 )
            v13 = (unsigned int)a3;
          LODWORD(SecureHandle) = a4;
          v14 = MiSecureVad(v10, (PVOID)a1, a2, v13, SecureHandle);
          MiUnlockAndDereferenceVad(v10);
          if( v14 >= 0 )
            return qword_140C4DB90 ^ *((_QWORD *)KeGetCurrentThread() + 23);
        }
      }
    }
  }
  return 0i64;
}

Referenced by: