MiCanGrantExecute

NTSTATUS __stdcall MiCanGrantExecute(_EPROCESS *CurrentProcess, VOID *VirtualAddress){
  _EWOW64PROCESS *WoW64Process; 
  __int8 bf_0; 
  _MMVAD *Address; 
  union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v6; 
  NTSTATUS result; 

  WoW64Process = CurrentProcess->WoW64Process;
  result = 0;
  if( WoW64Process )
  {
    if( WoW64Process->Machine == 332 )
    {
      if( ((unsigned int)KeFeatureBits & 0x40000000) != 0
        || (bf_0 = CurrentProcess->Pcb.Flags._bf_0, (bf_0 & 2) != 0)
        || ((unsigned int)KeFeatureBits & 0x80000000) == 0 && (bf_0 & 1) == 0 )
      {
        if( ((unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFFF000ui64) == 2147352576
          && (CurrentProcess->Flags3 & 1) == 0 )
        {
          return 1;
        }
        Address = MiLocateAddress(VirtualAddress);
        if( Address )
        {
          v6.LongFlags = (unsigned int)Address->Core.u;
          if( (v6.LongFlags & 0x70) != 48 && ((v6.LongFlags & 0x70) != 32 || (v6.LongFlags & 0xF80) != 128) )
            return 1;
        }
      }
    }
  }
  return result;
}

Referenced by: