NtResetWriteWatch

NTSTATUS __stdcall NtResetWriteWatch(VOID *ProcessHandle, VOID *BaseAddress, UINT64 RegionSize){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  _MMPTE *v8; 
  VOID *v9; 
  int v10; 
  INT64 v11; 
  _MMVAD_SHORT *v12; 
  int v13; 
  unsigned __int64 v15; 
  __int64 v16; 
  UINT64 Tag; 
  PVOID Object; 
  INT64 v19; 
  _KAPC_STATE ApcState; 

  Object = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  if( (unsigned __int64)BaseAddress > 0x7FFFFFFEFFFFi64 )
    return -1073741584;
  if( 0x7FFFFFFF0000i64 - (__int64)BaseAddress >= RegionSize && RegionSize )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    Process = CurrentThread->Tcb.ApcState.Process;
    v8 = (_MMPTE *)((char *)BaseAddress + RegionSize - 1);
    if( ProcessHandle == (VOID *)-1i64 )
    {
      v9 = CurrentThread->Tcb.ApcState.Process;
      v10 = 0;
    }
    else
    {
      LODWORD(Tag) = 2002218317;
      v13 = ObReferenceObjectByHandleWithTag(
              ProcessHandle,
              8ui64,
              (_OBJECT_TYPE *)PsProcessType,
              CurrentThread->Tcb.PreviousMode,
              Tag,
              &Object,
              0i64);
      if( v13 < 0 )
        return v13;
      v9 = Object;
      v10 = 0;
      if( Process != Object )
      {
        KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
        v10 = 1;
      }
    }
    LODWORD(v11) = MiObtainReferencedVadEx((UINT64)BaseAddress, 0, &v19);
    v12 = (_MMVAD_SHORT *)v11;
    if( !v11 )
    {
      v13 = -1073741585;
      goto LABEL_10;
    }
    if( (*(_DWORD *)(v11 + 48) & 0x300000) == 3145728
      && (unsigned __int64)v8 <= (((*(unsigned int *)(v11 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v11 + 33) << 32)) << 12) | 0xFFF) )
    {
      LODWORD(v15) = MiGetVadMandatoryPageSize(v11);
      if( v15 <= 1 )
      {
LABEL_17:
        MiMoveDirtyBitsToPfns((_MMPTE *)BaseAddress, v8, (INT64)v12, FlushUser);
        v13 = 0;
        goto LABEL_9;
      }
      v16 = (v15 << 12) - 1;
      if( (v16 & (unsigned __int64)BaseAddress) == 0 )
      {
        if( (v16 & RegionSize) != 0 )
        {
          v13 = -1073741583;
          goto LABEL_9;
        }
        goto LABEL_17;
      }
    }
    v13 = -1073741585;
LABEL_9:
    MiUnlockAndDereferenceVad(v12);
LABEL_10:
    if( v10 )
      KeUnstackDetachProcess(&ApcState);
    if( ProcessHandle != (VOID *)-1i64 )
      ObfDereferenceObjectWithTag(v9, 0x77576D4Dui64);
    return v13;
  }
  return -1073741583;
}

Referenced by: