MiKernelWriteToExecutableMemory

NTSTATUS __stdcall MiKernelWriteToExecutableMemory(INT64 a1, INT64 a2, _EPROCESS *a3){
  _MMWSL_INSTANCE *VmWorkingSetList; 
  INT16 *v7; 
  char *v8; 
  _MMPTE *NextPteToAccessClear; 
  INT16 v10; 
  VOID *v11; 
  INT64 v12; 
  INT64 v13; 
  NTSTATUS v14; 
  INT64 v15; 
  INT64 v16; 
  __int64 v17; 
  INT64 v19; 

  VmWorkingSetList = a3->Vm.Instance.VmWorkingSetList;
  v7 = (INT16 *)(a1 + 56);
  v8 = (char *)MmGetPteBase() + ((*(_QWORD *)a1 >> 9) & 0x7FFFFFFFF8i64);
  NextPteToAccessClear = VmWorkingSetList[15].NextPteToAccessClear;
  v10 = MiReleaseFaultState(a1 + 56, 0x11u, 0i64);
  if( NtWaitLowEventPair(v11) >= 0 )
  {
    MiRelockFaultState(v7, v10, v12, v13, v19);
    if( NextPteToAccessClear == VmWorkingSetList[15].NextPteToAccessClear
      && ((*(_BYTE *)(a1 + 69) & 1) == 0 || MmIsAddressValidEx((INT64)v8)) )
    {
      LODWORD(v17) = MI_READ_PTE_LOCK_FREE((INT64)v8);
      return((a2 ^ v17) & 0xFFFFFFFFFFFFFFDFui64) != 0 ? 0xC0000434 : 0;
    }
    else
    {
      return -1073740748;
    }
  }
  else
  {
    MiForceCrashForInvalidAccess(a3);
    v14 = -1073739997;
    MiRelockFaultState(v7, v10, v15, v16, v19);
  }
  return v14;
}

Referenced by: