MiGetPageProtection

void MiGetPageProtection(ULONG_PTR BugCheckParameter2, ULONG_PTR a2, __int64 **a3, _DWORD *a4, ...){
  _WORD *v4; 
  ULONG_PTR v5; 
  ULONG_PTR v7; 
  _MMPTE *Pml4eBase; 
  _MMPTE *PxeUserLimit; 
  int v11; 
  int v12; 
  ULONG_PTR v13; 
  UNICODE_STRING *v14; 
  wchar_t *Buffer; 
  int v16; 
  _MMPTE *PteBase; 
  __int64 v18; 
  unsigned __int64 v19; 
  _MMPTE *ProtoPteAddress; 
  _QWORD *v21; 
  UINT64 v22; 
  __int64 v23; 
  __int64 v24; 
  _WORD *v25; 
  __int64 CurrentProcess; 
  _QWORD *CloneAddress; 
  _MMPFN *v28; 
  _SUBSECTION *ContainingSubsection; 
  _MMPFN *a3a; 
  __int64 **v31; 
  _DWORD *v32; 
  __int64 v33; 
  va_list va; 
  va_list va1; 
  va_start(va1, a4);
  va_start(va, a4);
  v33 = va_arg(va1, _QWORD);
  v32 = a4;
  v31 = a3;
  v4 = (_WORD *)v33;
  v5 = *(_QWORD *)a2;
  v7 = a2;
  a3a = 0i64;
  ContainingSubsection = 0i64;
  *(_WORD *)v33 = 0;
  *a3 = 0i64;
  *a4 = 0;
  Pml4eBase = MmGetPml4eBase();
  PxeUserLimit = MmGetPxeUserLimit();
  v11 = *(_DWORD *)(BugCheckParameter2 + 48);
  v12 = v11 & 0x70;
  v33 = v5;
  if( v12 == 48 && ((v11 & 0x100000) == 0 || (v11 & 0x1000000) != 0 || (v11 & 0x2000000) == 0) )
  {
    *v4 = MiGetValidAwePartitionId(v5);
    MiGetValidAweProtection(BugCheckParameter2, v5);
    return;
  }
  if( (v5 & 1) != 0 )
  {
    if( va < (va_list)Pml4eBase || va > (va_list)PxeUserLimit )
      a2 = v5;
    v13 = (a2 >> 12) & 0xFFFFFFFFFi64;
    v14 = (UNICODE_STRING *)((char *)MmGetPfnDb() + 48 * v13);
    if( v12 == 16 )
    {
      if( (unsigned int)MiIsPfn(v13) )
        *v4 = ((unsigned __int64)v14[2].Buffer >> 39) & 0x3FF;
    }
    else if( v12 != 64 || !(unsigned int)MiRotatedToFrameBuffer((MMPTE *)v7) )
    {
      Buffer = v14[2].Buffer;
      *v4 = ((unsigned __int64)Buffer >> 39) & 0x3FF;
      if( ((unsigned __int64)Buffer & 0x1000000000i64) != 0 )
      {
        MiGetProtectionFromPte((PVOID)BugCheckParameter2, (PVOID)v5);
        if( (*(_DWORD *)(BugCheckParameter2 + 48) & 0x1100000) == 17825792 )
          *v32 = 0;
      }
      else
      {
        LOBYTE(v16) = MI_PFN_IS_PROTO(v14, (UNICODE_STRING *)0x3FF, (UINT8)a3, (PWCHAR)a4);
        if( v16 )
        {
          PteBase = MmGetPteBase();
          if( ((*(_QWORD *)((char *)PteBase
                           + ((((__int64)((v7 << 25) - ((_QWORD)PteBase << 25)) >> 16) & 0xFFFFFFFFF000ui64) >> 9)) >> 60) & 7) == 0
            && (__int64)v14->Buffer <= 0 )
          {
            v18 = *((_QWORD *)KeGetCurrentThread() + 23);
            if( *(_QWORD *)(v18 + 1264) )
              MiLocateCloneAddress(v18, (unsigned __int64)v14->Buffer | 0x8000000000000000ui64);
          }
        }
      }
    }
    return;
  }
  if( (v5 & 0x400) != 0 )
  {
    if( MiIsPrototypePteVadLookup(v5) )
    {
      if( (v11 & 0x100000) == 0 )
      {
        *v4 = **(_WORD **)(qword_140C4E388 + 8i64 * (*(_WORD *)(**(_QWORD **)(BugCheckParameter2 + 72) + 60i64) & 0x3FF));
        v19 = (unsigned __int64)((__int64)((v7 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16) >> 12;
        ProtoPteAddress = MiGetProtoPteAddress((_MMVAD *)BugCheckParameter2, v19, 4ui64, &ContainingSubsection);
        if( ProtoPteAddress )
        {
          v21 = *(_QWORD **)(BugCheckParameter2 + 120);
          if( ((__int64)v21 >= 0
             || v19
              - (*(unsigned int *)(BugCheckParameter2 + 24) | ((unsigned __int64)*(unsigned __int8 *)(BugCheckParameter2 + 32) << 32)) <= (unsigned __int64)(*v21 - 1i64) >> 12)
            && !*(_QWORD *)(*(_QWORD *)ContainingSubsection + 64i64)
            && (*(_DWORD *)(*(_QWORD *)ContainingSubsection + 56i64) & 0x2000) == 0 )
          {
            if( (int)MiTryLockProtoPoolPageAtDpc((INT64 *)ProtoPteAddress, (INT64)v21, &a3a, 0i64) < 0 )
            {
              *v31 = (__int64 *)ProtoPteAddress;
            }
            else
            {
              MI_READ_PTE_LOCK_FREE((INT64)ProtoPteAddress);
              LOBYTE(v22) = 2;
              MiUnlockProtoPoolPage(a3a, v22);
            }
          }
        }
      }
      return;
    }
    v23 = v5;
    if( qword_140C4DC80 && (v5 & 0x10) == 0 )
      v23 = v5 & ~qword_140C4DC80;
    v24 = v23 >> 16;
    if( MI_PROTO_FORMAT_COMBINED(v5) )
    {
      v25 = **(_WORD ***)(((v24 - 48) & 0xFFFFFFFFFFFFF000ui64) + 0x10);
LABEL_45:
      *v4 = *v25;
      MiCaptureProtectionFromLockedProto((MMPTE *)v24);
      return;
    }
    CurrentProcess = PsGetCurrentProcess();
    if( *(_QWORD *)(CurrentProcess + 1264) )
    {
      CloneAddress = MiLocateCloneAddress(CurrentProcess, v24);
      if( CloneAddress )
      {
        v25 = *(_WORD **)(CloneAddress[7] + 24i64);
        goto LABEL_45;
      }
    }
    if( v12 != 32 || (v11 & 0xF80) != 896 )
      KeBugCheckEx(0x1Au, 0x41202ui64, v7, v5, BugCheckParameter2);
    *v4 = **(_WORD **)(qword_140C4E388 + 8i64 * (*(_WORD *)(**(_QWORD **)(BugCheckParameter2 + 72) + 60i64) & 0x3FF));
    MiGetImageProtoProtection((_MMVAD_SHORT *)BugCheckParameter2, (_MMPTE *)v24);
  }
  else
  {
    if( (v5 & 0x800) != 0 && (v28 = MiLockTransitionLeafPage((_MMPTE *)a2, 0i64)) != 0i64 )
    {
      *v4 = (*((_QWORD *)v28 + 5) >> 39) & 0x3FF;
      _InterlockedAnd64((volatile signed __int64 *)v28 + 3, 0x7FFFFFFFFFFFFFFFui64);
    }
    else
    {
      *v4 = **(_WORD **)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(PsGetCurrentProcess() + 1838));
    }
    if( (*(_DWORD *)(BugCheckParameter2 + 48) & 0x1100000) == 17825792 )
      *a4 = 0;
  }
}

Referenced by: