ExProtectPoolEx

UINT64 __stdcall ExProtectPoolEx(
        VOID *AllocationAddress,
        VOID *ProtectAddress,
        UINT64 NumberOfBytes,
        UINT64 NewProtect){
  unsigned int v4; 
  NTSTATUS v6; 
  __int64 v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  char v10; 
  int v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  int v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  unsigned __int64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  __int64 v21; 
  unsigned int v22; 
  unsigned __int64 v24; 

  v4 = NewProtect;
  if( (((unsigned __int64)ProtectAddress | (unsigned __int64)AllocationAddress) & 0xFFF) != 0 )
    return 0i64;
  v6 = MiDeterminePoolType((UINT64)ProtectAddress);
  v10 = 0;
  if( v6 != 32 )
    v10 = v6;
  if( (v10 & 0x20) != 0 )
    return 0i64;
  v24 = v7 + v8 - 1;
  v11 = 0;
  v12 = 0i64;
  LOWORD(v13) = 0;
  LOBYTE(v14) = 0;
  v15 = ((40543 * (unsigned __int64)(unsigned int)(v9 >> 12)) >> 32) ^ (40543i64 * (unsigned int)(v9 >> 12));
  v16 = (unsigned __int8)ExAcquireSpinLockShared(&ExpLargePoolTableLock);
  if( !PoolBigPageTable )
  {
    ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)&ExpLargePoolTableLock);
    __writecr8(v16);
    return 0i64;
  }
  v17 = PoolBigPageTable + 24 * PoolBigPageTableSize;
  v18 = v24;
  v19 = PoolBigPageTable + 24i64 * ((unsigned int)v15 & ((_DWORD)PoolBigPageTableSize - 1));
  while( 1 )
  {
    v20 = *(_QWORD *)v19;
    if( (*(_QWORD *)v19 & 1) != 0 )
      goto LABEL_16;
    if( (unsigned __int64)ProtectAddress < v20 )
      goto LABEL_16;
    v21 = *(_QWORD *)(v19 + 16);
    if( v18 >= v21 + v20 )
      goto LABEL_16;
    if( (v21 & 0xFFF) == 0 || ((v24 + 4095) & 0xFFFFFFFFFFFFF000ui64) < ((v21 + v20 + 4095) & 0xFFFFFFFFFFFFF000ui64) )
      break;
    v18 = v24;
LABEL_16:
    v19 += 24i64;
    if( v19 >= v17 )
    {
      if( v11 == 1 )
        goto LABEL_12;
      v19 = PoolBigPageTable;
      v11 = 1;
      v17 = PoolBigPageTable + 24i64 * ((unsigned int)v15 & ((_DWORD)PoolBigPageTableSize - 1));
    }
  }
  v12 = *(_QWORD *)v19;
  v14 = *(_DWORD *)(v19 + 12) >> 8;
  v13 = *(_QWORD *)(v19 + 16);
LABEL_12:
  ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)&ExpLargePoolTableLock);
  __writecr8(v16);
  if( !v12 )
    return 0i64;
  v22 = v13 & 0xFFF;
  if( v22 )
  {
    if( (v14 & 0x40) == 0 || v22 > 0x10ui64 )
      return 0i64;
  }
  if( v4 == -1 )
    return 1i64;
  else
    return MmProtectPool((UINT64)ProtectAddress, NumberOfBytes, v4);
}

Referenced by: