MmSecureVirtualMemoryAgainstWrites

NTSTATUS __fastcall MmSecureVirtualMemoryAgainstWrites(_EPROCESS *Process, VOID *Base, UINT64 Size){
  VOID *v3; 
  _DWORD *v7; 
  unsigned __int64 v8; 
  INT64 v9; 
  INT64 v10; 
  int v11; 
  _MMVAD_SHORT *v12; 
  int v13; 
  _MMVAD *v14; 
  int v15; 
  _EPROCESS *v17; 
  INT64 v18; 
  _KAPC_STATE ApcState; 

  v3 = (VOID *)((unsigned __int64)Base & 0xFFFFFFFFFFFFF000ui64);
  memset(&ApcState, 0, sizeof(ApcState));
  if( (VOID *)((unsigned __int64)Base & 0xFFFFFFFFFFFFF000ui64) != Base || (Size & 0xFFF) != 0 )
    return 0;
  v7 = 0i64;
  v8 = ((unsigned __int64)Base + Size - 1) | 0xFFF;
  v17 = KeGetCurrentThread()->ApcState.Process;
  if( v17 == Process )
    v17 = 0i64;
  else
    KiStackAttachProcess(Process, 0i64, &ApcState);
  LODWORD(v9) = MiObtainReferencedVadEx((UINT64)v3, 0, &v18);
  v10 = v9;
  if( v9 )
  {
    if( v8 >> 12 <= (*(unsigned int *)(v9 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v9 + 33) << 32)) )
    {
      LOBYTE(v11) = MiVadSupportsPrivateCommit(v9);
      if( v11 )
      {
        if( ((*(_DWORD *)(v10 + 48) & 8) == 0 || MiCheckSecuredVad(v12, Base, Size, 1ui64) >= 0)
          && (*(_DWORD *)(v10 + 48) & 0x100000) == 0
          && (*(_DWORD *)(v10 + 64) & 0x4000000) == 0
          && (MmCompatibleProtectionMask[(*(_DWORD *)(v10 + 48) >> 7) & 7] | 0x702) == (MmCompatibleProtectionMask[(*(_DWORD *)(v10 + 48) >> 7) & 7] | 0x700) )
        {
          if( (v13 = *(_DWORD *)(**(_QWORD **)(v10 + 72) + 56i64), (v13 & 0x80u) != 0) && (v13 & 0x20) == 0
            || !MiVadMapsLargeImage((_MMVAD *)v10) && (MiIsRangeFullyCommitted(v14, v3, (VOID *)v8), v15) )
          {
            if( MiSetReadOnlyOnSectionView(Process, (_MMVAD *)v10, v3, (VOID *)v8) >= 0 )
            {
              v7 = MiAddSecureEntry((_MI_PARTITION *)v10, (__int64)v3, v8, -1073741823, 0);
              if( !v7 )
                MiUnsecureVirtualMemoryAgainstWrites((_MMVAD *)v10, v3, (VOID *)v8);
            }
          }
        }
      }
    }
    MiUnlockAndDereferenceVad((_MMVAD_SHORT *)v10);
  }
  if( v17 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  if( v7 )
    LODWORD(v7) = (unsigned int)Process ^ *(&stru_140C4DB30 + 24) ^ (unsigned int)v7;
  return(int)v7;
}

Referenced by: