MiAllowProtectionChange

VOID __fastcall MiAllowProtectionChange(
        _EPROCESS *Process,
        _EPROCESS *CreatingProcess,
        _MMVAD *Vad,
        UINT64 NewProtectionMask,
        VOID *StartingAddress,
        VOID *EndingAddress){
  char v6; 
  int v9; 
  UINT64 v10; 
  _MMVAD_SHORT *v11; 
  char v12; 
  char v13; 
  VOID *v14; 
  int v15; 
  VOID *VaWithProto; 
  int v17; 
  __int64 ReturnedProtect[2]; 

  v6 = NewProtectionMask;
  *(__int64 *)((char *)ReturnedProtect + 4) = 0i64;
  LODWORD(ReturnedProtect[0]) = 0;
  HIDWORD(VaWithProto) = 0;
  v17 = 0;
  LOWORD(VaWithProto) = 0;
  if( (NewProtectionMask & 2) == 0 || (Vad->Core.u.LongFlags & 0xC00) != 3072 || (Vad->Core.u.LongFlags & 0x380) == 0 )
  {
    v9 = 0;
    MiLockWorkingSetShared();
    v13 = v12;
    v14 = StartingAddress;
    if( StartingAddress <= EndingAddress )
    {
      while( 1 )
      {
        LOBYTE(v11) = v13;
        MiQueryAddressState(
          v14,
          (UINT8)EndingAddress,
          v11,
          (_EPROCESS *)Vad,
          0i64,
          (VOID **)((char *)&VaWithProto + 4),
          (UINT64 *)ReturnedProtect,
          &VaWithProto);
        v15 = HIDWORD(VaWithProto);
        if( HIDWORD(VaWithProto) == -1 )
          v15 = 0;
        HIDWORD(VaWithProto) = v15;
        if( (v15 & 2) == 0 && (v6 & 2) != 0 || (v15 & 2) != 0 && (v6 & 4) != 0 )
          break;
        v14 = *(VOID **)((char *)ReturnedProtect + 4);
        if( *(__int64 *)((char *)ReturnedProtect + 4) > (unsigned __int64)EndingAddress )
          goto LABEL_11;
      }
      v9 = 1;
    }
LABEL_11:
    LOBYTE(v10) = v13;
    MiUnlockWorkingSetShared(&Process->Vm.Instance, v10);
    if( v9 )
      MiArbitraryCodeBlocked(CreatingProcess);
  }
}

Referenced by: