MmProtectMdlSystemAddress

NTSTATUS __stdcall MmProtectMdlSystemAddress(_MDL *MemoryDescriptorList, UINT64 NewProtect){
  unsigned int v2; 
  unsigned __int64 MappedSystemVa; 
  unsigned int ProtectionMask; 
  unsigned int v7; 
  __int64 v8; 
  __int64 ByteCount; 
  __int16 v10; 
  VOID *v11; 
  int v12; 
  _XSTATE_CONFIGURATION *v13; 
  VOID *v14; 
  UINT64 BugCheckParameter4; 
  unsigned __int64 v16; 
  int v17; 
  __int64 v18; 
  UINT64 v19; 
  __int64 v20; 
  int v21; 
  int v22; 
  unsigned __int64 v23; 
  int v24; 
  __int64 v25; 
  bool v26; 
  int v27; 
  unsigned __int8 CurrentIrql; 
  _RTL_BALANCED_NODE *v29; 
  int v30; 
  _RTL_BALANCED_NODE *v31; 
  UINT64 v32; 
  UINT64 v33; 
  unsigned __int64 v34; 
  int v35; 
  NTSTATUS HasIoTracker; 
  UINT64 v37; 
  VOID *v38; 
  unsigned __int64 v39; 
  PVOID BugCheckParameter2; 
  _MI_TB_FLUSH_LIST TbFlushList[48]; 

  v2 = NewProtect;
  BugCheckParameter2 = MemoryDescriptorList;
  memset(TbFlushList, 0i64, 0xB8u);
  if( (MemoryDescriptorList->MdlFlags & 1) == 0 )
    return -1073741799;
  MappedSystemVa = (unsigned __int64)MemoryDescriptorList->MappedSystemVa;
  if( MI_IS_PHYSICAL_ADDRESS((VOID *)MappedSystemVa) )
    return -1073741637;
  ProtectionMask = MiMakeProtectionMask(v2);
  v7 = ProtectionMask;
  if( ProtectionMask == -1
    || (ProtectionMask >> 3) - 1 <= 1
    || ProtectionMask >> 3 == 3 && (ProtectionMask & 7) != 0
    || (ProtectionMask & 5) == 5 )
  {
    return -1073741755;
  }
  v8 = (MappedSystemVa >> 9) & 0x7FFFFFFFF8i64;
  ByteCount = MemoryDescriptorList->ByteCount;
  v10 = MappedSystemVa;
  *(_QWORD *)&TbFlushList[6] = 0i64;
  v11 = (VOID *)(MappedSystemVa & 0xFFFFFFFFFFFFF000ui64);
  TbFlushList[2] = 20;
  v38 = v11;
  v12 = 0;
  v13 = (_XSTATE_CONFIGURATION *)((char *)MmGetPteBase() + v8);
  v39 = ((unsigned __int64)(v10 & 0xFFF) + ByteCount + 4095) >> 12;
  v14 = v11;
  HasIoTracker = 0;
  if( v39 )
  {
    do
    {
      LODWORD(BugCheckParameter4) = MI_READ_PTE_LOCK_FREE((INT64)v13);
      v37 = BugCheckParameter4;
      v16 = BugCheckParameter4;
      if( (BugCheckParameter4 & 1) != 0 )
      {
        v17 = 1;
        MiPteInShadowRange((UINT64)&v37);
        v18 = (v16 >> 12) & 0xFFFFFFFFFi64;
        MiInsertTbFlushEntry(TbFlushList, v14, 1ui64, 0i64);
        if( v14 == v11 )
          HasIoTracker = MiMappingHasIoTracker(v11);
      }
      else
      {
        if( (BugCheckParameter4 & 0x800) == 0 || ((BugCheckParameter4 >> 5) & 0x1F) != 24 )
          KeBugCheckEx(0x1Au, (PVOID)0x1235, BugCheckParameter2, v13, (PVOID)BugCheckParameter4);
        if( *(&stru_140C4DB30 + 42) )
        {
          if( (BugCheckParameter4 & 0x10) != 0 )
            v16 = BugCheckParameter4 & 0xFFFFFFFFFFFFFFEFui64;
          else
            v16 = BugCheckParameter4 & ~*(&stru_140C4DB30 + 42);
        }
        v18 = (v16 >> 12) & 0xFFFFFFFFFi64;
        v17 = 0;
        if( v14 == v11 )
        {
          if( (BugCheckParameter4 & 8) != 0 )
            v12 = 1;
          HasIoTracker = v12;
        }
      }
      if( v7 == 24 )
      {
        LODWORD(v19) = MiMakeTransitionPte(v18, 24);
        v37 = v19;
        v20 = v19;
        if( v21 == v22 && v14 == v11 )
        {
          v20 = v19 | 8;
          v37 = v19 | 8;
        }
        v23 = v20;
        LOBYTE(v24) = MiPteInShadowRange((UINT64)v13);
        if( v24 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v20 & 1) != 0 )
          v23 = v20 | 0x8000000000000000ui64;
        v13->EnabledFeatures = v23;
        v12 = HasIoTracker;
      }
      else
      {
        if( (MmGetPfnDb()[v18].u4._bf_0 & 0x4000000000000i64) != 0 )
        {
          MiMakeProtectionPfnCompatible((_BYTE *)v7, &MmGetPfnDb()[v18]);
        }
        else
        {
          CurrentIrql = KeGetCurrentIrql();
          __writecr8(2ui64);
          v29 = MiIoSpaceIsConstant(v18, 1i64);
          __writecr8(CurrentIrql);
          if( v29 )
          {
            v30 = *(_DWORD *)&v29[1]._bf_0;
          }
          else
          {
            v31 = MiLookupIoPageNode(v18);
            if( !v31 )
              KeBugCheckEx(0x1Au, (PVOID)0x61949, (PVOID)v18, (PVOID)1, 0i64);
            v30 = *((unsigned __int16 *)v31[2].Children[0]->Children + v18 - v31[1].ParentValue) >> 14;
          }
          v27 = v7 & 7;
          if( v30 )
          {
            if( v30 == 2 )
              v27 |= 0x18u;
          }
          else
          {
            v27 |= 8u;
          }
        }
        LODWORD(v32) = MiMakeValidPte(v13, v18, v27 | 0xA0000000);
        v37 = v32;
        v33 = v32;
        if( v17 == 1 )
        {
          MiWriteValidPteNewProtection((INT64 *)v13, v32);
        }
        else
        {
          v34 = v32;
          LOBYTE(v35) = MiPteInShadowRange((UINT64)v13);
          if( v35 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v33 & 1) != 0 )
            v34 = v33 | 0x8000000000000000ui64;
          v13->EnabledFeatures = v34;
        }
        v12 = HasIoTracker;
        if( HasIoTracker == 1 )
        {
          v25 = (__int64)v38;
          if( v38 == v11 )
            MiMappingHasIoReferences(v11);
          goto LABEL_35;
        }
      }
      v25 = (__int64)v38;
LABEL_35:
      v14 = (VOID *)(v25 + 4096);
      v13 = (_XSTATE_CONFIGURATION *)((char *)v13 + 8);
      v26 = v39-- == 1;
      v38 = v14;
    }
    while( !v26 );
  }
  MiFlushTbList(TbFlushList);
  return 0;
}

Referenced by: