MiComparePteProtections

NTSTATUS __stdcall MiComparePteProtections(_EPROCESS *TargetProcess, VOID *Va, UINT64 WsIrql, INT64 a4, INT64 a5){
  NTSTATUS v5; 
  int v7; 
  _EPROCESS *Process; 
  UINT64 v11; 
  _MMVAD_SHORT *v12; 
  char v13; 
  char v14; 
  int v15; 
  bool v16; 
  char ReturnedProtect[12]; 
  VOID *NextVaToQuery; 
  VOID *VaWithProto; 

  v5 = 0;
  v7 = a4;
  LODWORD(VaWithProto) = 0;
  memset(ReturnedProtect, 0, sizeof(ReturnedProtect));
  LOWORD(NextVaToQuery) = 0;
  Process = KeGetCurrentThread()->ApcState.Process;
  MiLockWorkingSetShared();
  v14 = v13;
  while( (unsigned __int64)Va <= WsIrql )
  {
    LOBYTE(v12) = v14;
    MiQueryAddressState(Va, WsIrql, v12, TargetProcess, 0i64, &VaWithProto, (UINT64 *)ReturnedProtect, &NextVaToQuery);
    v15 = (int)VaWithProto;
    if( !(_DWORD)VaWithProto )
    {
      v16 = ((LODWORD(TargetProcess->Pcb.ThreadListHead.Flink) >> 7) & 0x1F) == 0;
      v15 = (LODWORD(TargetProcess->Pcb.ThreadListHead.Flink) >> 7) & 0x1F;
      LODWORD(VaWithProto) = v15;
      if( v16 )
        goto LABEL_13;
    }
    if( (_DWORD)a5 == 1 )
    {
      if( v15 != v7 )
        goto LABEL_13;
    }
    else if( v15 == -1 || (v15 & 0xFFFFFFF8) == 16 || (v7 != 1 ? (v16 = (v15 & 4) == 0) : (v16 = (v15 & 7) == 0), v16) )
    {
LABEL_13:
      v5 = -1073741755;
      break;
    }
    Va = *(VOID **)&ReturnedProtect[4];
  }
  LOBYTE(v11) = v14;
  MiUnlockWorkingSetShared(&Process->Vm.Instance, v11);
  return v5;
}

Referenced by: