NtProtectVirtualMemory

NTSTATUS __stdcall NtProtectVirtualMemory(
        VOID *ProcessHandle,
        VOID **BaseAddress,
        UINT64 *RegionSize,
        UINT64 NewProtectWin32,
        UINT64 *OldProtect){
  unsigned int v5; 
  VOID *v7; 
  UINT64 *v8; 
  int v9; 
  NTSTATUS ProtectionMask; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  INT8 PreviousMode; 
  __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  VOID *v17; 
  UINT64 v18; 
  NTSTATUS result; 
  PFN_WDFDRIVERERRORREPORTAPIMISSING *v20; 
  NTSTATUS v21; 
  NTSTATUS v22; 
  int v23; 
  INT64 Tag; 
  INT64 Taga; 
  INT64 Tagb; 
  PVOID *Object; 
  char v28; 
  char DeviceObject[12]; 
  PVOID v30; 
  _XSTATE_FEATURE *v31; 
  UINT64 *v32; 
  UINT64 *v33; 
  _KAPC_STATE ApcState; 

  v5 = NewProtectWin32;
  v32 = RegionSize;
  v7 = ProcessHandle;
  v8 = OldProtect;
  v33 = OldProtect;
  memset(&ApcState, 0, sizeof(ApcState));
  v9 = 0;
  v30 = 0i64;
  v31 = 0i64;
  memset(DeviceObject, 0, sizeof(DeviceObject));
  if( v5 == 0x80000000 || v5 == 0x10000000 )
  {
    LOBYTE(ProtectionMask) = 24;
  }
  else
  {
    ProtectionMask = MiMakeProtectionMask(v5 & 0xFF807FF);
    if( ProtectionMask == -1 )
      return -1073741755;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = CurrentThread->Tcb.ApcState.Process;
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  v28 = PreviousMode;
  if( PreviousMode )
  {
    v14 = (__int64)BaseAddress;
    if( (unsigned __int64)BaseAddress >= 0x7FFFFFFF0000i64 )
      v14 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v14 = *(_QWORD *)v14;
    v15 = (__int64)RegionSize;
    if( (unsigned __int64)RegionSize >= 0x7FFFFFFF0000i64 )
      v15 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v15 = *(_QWORD *)v15;
    v16 = (__int64)v8;
    if( (unsigned __int64)v8 >= 0x7FFFFFFF0000i64 )
      v16 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v16 = *(_DWORD *)v16;
    v17 = *BaseAddress;
    *(_QWORD *)&DeviceObject[4] = *BaseAddress;
    v18 = *RegionSize;
    v31 = (_XSTATE_FEATURE *)*RegionSize;
    PreviousMode = v28;
  }
  else
  {
    v18 = *RegionSize;
    v31 = (_XSTATE_FEATURE *)*RegionSize;
    v17 = *BaseAddress;
    *(_QWORD *)&DeviceObject[4] = *BaseAddress;
  }
  if( (unsigned __int64)v17 > 0x7FFFFFFEFFFFi64 )
    return -1073741584;
  if( 0x7FFFFFFF0000i64 - (__int64)v17 < v18 || !v18 )
    return -1073741583;
  LODWORD(Tag) = 1984982349;
  result = ObReferenceObjectByHandleWithTag(v7, 8ui64, (_OBJECT_TYPE *)PsProcessType, PreviousMode, Tag, &v30, 0i64);
  if( result >= 0 )
  {
    v20 = (PFN_WDFDRIVERERRORREPORTAPIMISSING *)v30;
    if( Process != v30 )
    {
      KeStackAttachProcess((PRKPROCESS)v30, &ApcState);
      v9 = 1;
    }
    LODWORD(Taga) = v5;
    if( ((_BYTE)v20[124] & 1) != 0 )
      v21 = VslDebugProtectSecureProcessMemory(
              (__int64)v20,
              (__int64)Process,
              (__int64 *)&DeviceObject[4],
              (__int64 *)&v31,
              v5,
              DeviceObject);
    else
      v21 = MmProtectVirtualMemory(
              (PFN_WDFDRIVERERRORREPORTAPIMISSING *)Process,
              v20,
              (PFN_WDFDEVICEWDMDISPATCHPREPROCESSEDIRP **)&DeviceObject[4],
              &v31,
              Taga,
              (PFN_WDFDEVICEWDMDISPATCHPREPROCESSEDIRP *)DeviceObject);
    v22 = v21;
    LODWORD(v30) = v21;
    if( v9 )
      KeUnstackDetachProcess(&ApcState);
    if( v22 >= 0
      && (((unsigned __int8)MiMakeProtectionMask(*(unsigned int *)DeviceObject) | (unsigned __int8)ProtectionMask) & 2) != 0 )
    {
      LODWORD(Object) = v23;
      LODWORD(Tagb) = v5;
      EtwTiLogProtectExecVm((__int64)v20, v28, *(_QWORD *)&DeviceObject[4], v18, Tagb, Object);
    }
    ObfDereferenceObjectWithTag(v20, 0x76506D4Dui64);
    *v32 = (UINT64)v31;
    *BaseAddress = *(VOID **)&DeviceObject[4];
    *(_DWORD *)v33 = *(_DWORD *)DeviceObject;
    return v22;
  }
  return result;
}

Referenced by: