MiGetPfnProtection

INT64 __fastcall MiGetPfnProtection(__int64 a1, unsigned __int64 a2, __int64 a3){
  UINT8 WsleContents; 
  UINT64 v5; 
  INT64 result; 
  unsigned __int64 v7; 
  __int64 v8; 
  WsleContents = MiGetWsleContents(a1, a2);
  result = MiGetWsleProtection(v5, WsleContents);
  if( !(_DWORD)result )
  {
    v7 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE(a3 + 16) >> 5) & 0x1F;
    if( (*(_QWORD *)(a3 + 40) & 0x1000000000i64) != 0 || *(__int64 *)(a3 + 8) <= 0 )
    {
      v8 = *((_QWORD *)KeGetCurrentThread() + 23);
      if( *(_QWORD *)(v8 + 1264) )
      {
        if( MiLocateCloneAddress(v8, *(_QWORD *)(a3 + 8) | 0x8000000000000000ui64) )
          LODWORD(v7) = MmMakeProtectNotWriteCopy[(unsigned int)v7];
      }
      return(unsigned int)v7;
    }
    else
    {
      return(unsigned int)MmMakeProtectNotWriteCopy[(unsigned int)v7];
    }
  }
  return result;
}

Referenced by: