MiGetImageProtoProtection

VOID __stdcall MiGetImageProtoProtection(_MMVAD_SHORT *Vad, _MMPTE *ProtoPte){
  __int64 i; 
  unsigned __int64 v4; 
  __int64 v5; 
  unsigned int SessionId; 
  for( i = *((_QWORD *)Vad + 9); i; i = *(_QWORD *)(i + 16) )
  {
    if( (*(_BYTE *)(i + 34) & 2) != 0 && (v5 = *(_QWORD *)i, (*(_DWORD *)(*(_QWORD *)i + 56i64) & 0x4000000) != 0) )
    {
      SessionId = MmGetSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
      v4 = MiGetSharedProtos(v5, SessionId, i)[9];
    }
    else
    {
      v4 = *(_QWORD *)(i + 8);
    }
    if( (unsigned __int64)ProtoPte >= v4 && (unsigned __int64)ProtoPte < v4 + 8i64 * *(unsigned int *)(i + 44) )
      break;
  }
}

Referenced by: