MmLockPagableDataSection

VOID *__stdcall MmLockPagableDataSection(VOID *AddressWithinSection){
  INT64 v2; 
  _ETHREAD *CurrentThread; 
  VOID *v4; 
  _LIST_ENTRY *Flink; 
  char *v6; 
  __int64 v7; 
  unsigned int v8; 
  _DWORD *v9; 
  int v10; 
  unsigned __int64 v11; 
  unsigned int v12; 

  if( MI_IS_PHYSICAL_ADDRESS(AddressWithinSection) )
    return(VOID *)1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0i64;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceExclusiveLite((UINT64)&PsLoadedModuleResource, 1, v2);
  Flink = MiLookupDataTableEntry(AddressWithinSection, 0i64)[3].Flink;
  v6 = (char *)((_BYTE *)AddressWithinSection - (_BYTE *)Flink);
  LODWORD(v7) = RtlImageNtHeader((UINT64)Flink);
  v8 = *(unsigned __int16 *)(v7 + 6);
  v9 = (_DWORD *)(*(unsigned __int16 *)(v7 + 20) + v7 + 24);
  v10 = 0;
  if( *(_WORD *)(v7 + 6) )
  {
    while( 1 )
    {
      v11 = (unsigned int)v9[3];
      v12 = v9[4];
      if( (unsigned __int64)v6 >= v11 )
      {
        if( v12 < v9[2] )
          v12 = v9[2];
        if( (unsigned __int64)v6 < (unsigned int)v11 + v12 )
          break;
      }
      v9 += 10;
      if( ++v10 >= v8 )
        goto LABEL_10;
    }
    v4 = v9;
  }
LABEL_10:
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  if( !v4 )
    KeBugCheckEx(0x1Au, (PVOID)0x1234, AddressWithinSection, 0i64, 0i64);
  MiLockPagableImageSection(v4, 1u);
  return v4;
}

Referenced by: