MiGetImageProtoProtection

VOID __fastcall MiGetImageProtoProtection(_MMVAD_SHORT *Vad, _MMPTE *ProtoPte){
  unsigned int *i; 
  _RTL_BALANCED_NODE *v4; 
  _CONTROL_AREA *v5; 
  unsigned int SessionId; 

  for( i = (unsigned int *)Vad[1].ExtraCreateInfo; i; i = (unsigned int *)*((_QWORD *)i + 2) )
  {
    if( (*((_BYTE *)i + 34) & 2) != 0
      && (v5 = *(_CONTROL_AREA **)i, (*(_DWORD *)(*(_QWORD *)i + 56i64) & 0x4000000) != 0) )
    {
      SessionId = MmGetSessionIdEx(KeGetCurrentThread()->ApcState.Process);
      v4 = MiGetSharedProtos(v5, SessionId, (_SUBSECTION *)i)[3].Children[0];
    }
    else
    {
      v4 = (_RTL_BALANCED_NODE *)*((_QWORD *)i + 1);
    }
    if( ProtoPte >= (_MMPTE *)v4 && ProtoPte < (_MMPTE *)&v4->Children[i[11]] )
      break;
  }
}

Referenced by: