KiPageFault

NTSTATUS __stdcall KiPageFault(){
  unsigned __int64 v0; 
  unsigned __int64 v1; 
  unsigned __int64 v2; 
  unsigned __int64 v3; 
  unsigned __int64 v4; 
  unsigned __int64 v5; 
  unsigned __int64 v6; 
  _M128A v7; 
  _M128A v8; 
  _M128A v9; 
  _M128A v10; 
  _M128A v11; 
  _M128A v12; 
  _KTRAP_FRAME *__shifted(_KTRAP_FRAME,0x80) TrapFrame; 
  _ETHREAD *CurrentThread; 
  unsigned __int8 BpbKernelSpecCtrl; 
  unsigned __int8 BpbState; 
  ULONG64 v17; 
  _QWORD *Object; 
  bool v19; 
  unsigned int ErrorCode; 
  void *v21; 
  INT8 v22; 
  NTSTATUS v23; 
  _ETHREAD *v24; 
  _NT_TIB *UserGsBase; 
  INT64 v26; 
  INT64 v27; 
  unsigned __int8 CurrentIrql; 
  int v29; 
  INT64 v30; 
  INT64 v31; 
  INT64 v32; 
  unsigned __int64 P5_low; 
  _ETHREAD *v34; 
  _ETHREAD *v35; 
  INT64 R9; 
  INT64 R8; 
  unsigned __int8 BpbUserSpecCtrl; 
  unsigned __int8 v39; 
  NTSTATUS result; 
  CHAR v43; 
  void *retaddr; 
  __int16 PcValue; 
  int v46; 
  void *v47; 
  __int16 v48; 
  CHAR v49; 

  TrapFrame = KeGetTrapFrame();
  ADJ(TrapFrame)->ExceptionActive = 1;
  ADJ(TrapFrame)->_Rax = v0;
  ADJ(TrapFrame)->_Rcx = v2;
  ADJ(TrapFrame)->_Rdx = v1;
  ADJ(TrapFrame)->_R8 = v3;
  ADJ(TrapFrame)->_R9 = v4;
  ADJ(TrapFrame)->_R10 = v5;
  ADJ(TrapFrame)->_R11 = v6;
  if( (ADJ(TrapFrame)->SegCs & 1) != 0 )
  {
    if( (KiKvaShadow & 1) == 0 )
      __swapgs();
    _mm_lfence();
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    __writegsqword(0x270u, CurrentThread->Tcb.Process->SecurityDomain);
    __writegsbyte(0x851u, KeGetPcr()->Prcb.BpbRetpolineExitSpecCtrl);
    __writegsbyte(0x852u, KeGetPcr()->Prcb.BpbState);
    BpbKernelSpecCtrl = KeGetPcr()->Prcb.BpbKernelSpecCtrl;
    if( KeGetPcr()->Prcb.BpbCurrentSpecCtrl != BpbKernelSpecCtrl )
    {
      __writegsbyte(0x27Au, BpbKernelSpecCtrl);
      __writemsr(0x48u, BpbKernelSpecCtrl);
    }
    BpbState = KeGetPcr()->Prcb.BpbState;
    if( (BpbState & 8) != 0 )
    {
      __writemsr(0x49u, 1ui64);
      BpbState = KeGetPcr()->Prcb.BpbState;
    }
    if( (BpbState & 2) != 0 )
      __flush_rsb();
    _mm_lfence();
    __writegsbyte(0x853u, 0);
    if( ADJ(TrapFrame)->SegCs == 51 )
    {
      v17 = __readmsr(0xC0000102);
      ADJ(TrapFrame)->GsBase = v17;
      if( (char)CurrentThread->Tcb.gap0[3] < 0 )
      {
        if( v17 >= MmUserProbeAddress )
          v17 = MmUserProbeAddress;
        if( CurrentThread->Tcb.Teb != (void *)v17 )
        {
          Object = CurrentThread->Tcb.WaitBlock[3].Object;
          CurrentThread->Tcb._bf_0 |= 0x100u;
          --CurrentThread->Tcb.SpecialApcDisable;
          Object[16] = v17;
        }
      }
    }
    v19 = (CurrentThread->Tcb.gap0[3] & 3) == 0;
    LOWORD(ADJ(TrapFrame)->Dr7) = 0;
    if( !v19 )
      KiSaveDebugRegisterState();
  }
  else
  {
    _mm_lfence();
    if( (KeGetPcr()->Prcb.BpbState & 1) != 0 )
      __writemsr(0x48u, KeGetPcr()->Prcb.BpbCurrentSpecCtrl);
    else
      _mm_lfence();
  }
  ADJ(TrapFrame)->_MxCsr = _mm_getcsr();
  _mm_setcsr(KeGetPcr()->Prcb._MxCsr);
  ADJ(TrapFrame)->_Xmm0 = v7;
  ADJ(TrapFrame)->_Xmm1 = v8;
  ADJ(TrapFrame)->_Xmm2 = v9;
  ADJ(TrapFrame)->_Xmm3 = v10;
  ADJ(TrapFrame)->_Xmm4 = v11;
  ADJ(TrapFrame)->_Xmm5 = v12;
  if( (_BYTE)KeSmapEnabled && (ADJ(TrapFrame)->SegCs & 1) != 0 )
    __stac();
  ErrorCode = ADJ(TrapFrame)->ErrorCode;
  v21 = (void *)__readcr2();
  if( (ADJ(TrapFrame)->EFlags & 0x200) != 0 )
    _enable();
  if( _bittest((const signed __int32 *)&KeGetCurrentThread()->116, 8u) && (ADJ(TrapFrame)->SegCs & 1) != 0 )
    KiUmsTrapEntry((INT64)v21);
  ADJ(TrapFrame)->FaultAddress = (unsigned __int64)v21;
  if( !_bittest((const signed __int32 *)&ADJ(TrapFrame)->EFlags, 9u) )
  {
    CurrentIrql = -1;
    goto LABEL_51;
  }
  v22 = ADJ(TrapFrame)->SegCs & 1;
  ADJ(TrapFrame)->FaultIndicator = (ErrorCode >> 1) & 9;
  v23 = MmAccessFault(ErrorCode, v21, v22, ADJ(TrapFrame));
  if( v23 < 0 )
  {
    if( (ADJ(TrapFrame)->SegCs & 1) != 0 )
    {
      if( ADJ(TrapFrame)->SegCs == 51 )
      {
        v24 = (_ETHREAD *)KeGetCurrentThread();
        if( (v24->Tcb.gap0[3] & 4) != 0 )
          UserGsBase = (_NT_TIB *)v24->UserGsBase;
        else
          UserGsBase = KeGetPcr()->NtTib.$8E581AA5F14182E3A9376D7C6777905F::$DDD217EC770DED536E77C25F6874D4CC::Self;
        if( UserGsBase != (_NT_TIB *)ADJ(TrapFrame)->GsBase )
        {
          __writemsr(0xC0000102, (unsigned __int64)UserGsBase);
          goto LABEL_53;
        }
      }
      else if( HIDWORD(ADJ(TrapFrame)->FaultAddress) )
      {
        goto LABEL_53;
      }
    }
    v26 = (unsigned int)v23;
    v27 = 2i64;
    if( v23 != -805306362 )
    {
      if( v23 == -1073741819 )
      {
        v26 = 268435460i64;
      }
      else if( v23 != -2147483647 && v23 != -1073741571 )
      {
        v26 = 3221225478i64;
        v27 = 3i64;
      }
      KiExceptionDispatch(v26, v27, (VOID *)ADJ(TrapFrame)->_Rip, ADJ(TrapFrame)->FaultIndicator, v43);
    }
    CurrentIrql = KeGetCurrentIrql();
LABEL_51:
    KiBugCheckDispatch(
      0xAu,
      (void *)ADJ(TrapFrame)->FaultAddress,
      (void *)CurrentIrql,
      (void *)ADJ(TrapFrame)->FaultIndicator);
  }
  if( PsWatchEnabled )
    PsWatchWorkingSet((unsigned int)v23, (VOID *)ADJ(TrapFrame)->_Rip, (VOID *)ADJ(TrapFrame)->FaultAddress);
  if( KdpOweBreakpoint )
    KdSetOwedBreakpoints((VOID *)ADJ(TrapFrame)->FaultAddress);
LABEL_53:
  v29 = KeGetCurrentIrql();
  LODWORD(ADJ(TrapFrame)->P5) = v29;
  if( !v29 )
    __writecr8(1ui64);
  KiCheckForSListAddress(ADJ(TrapFrame));
  P5_low = LODWORD(ADJ(TrapFrame)->P5);
  if( !(_DWORD)P5_low )
    __writecr8(P5_low);
  _disable();
  if( (ADJ(TrapFrame)->SegCs & 1) == 0 )
  {
    _mm_setcsr(ADJ(TrapFrame)->_MxCsr);
    __iretq(retaddr, PcValue, v46, v47, v48);
  }
  if( (_BYTE)KeSmapEnabled )
    __stac();
  while( (KeGetCurrentThread()->ApcState.UserApcPendingAll & 3) != 0 )
  {
    __writecr8(1ui64);
    _enable();
    KiInitiateUserApc((_KTRAP_FRAME *)1);
    _disable();
    __writecr8(0i64);
  }
  if( (*((_BYTE *)&KeGetPcr()->Prcb.2 + 14) & 2) != 0 )
    KiUpdateStibpPairing(0i64);
  v34 = (_ETHREAD *)KeGetCurrentThread();
  if( (*(_DWORD *)v34->Tcb.gap0 & 0x8000000) != 0 )
    KiRestoreSetContextState((INT64)v34, v30, v31, v32, v43);
  v35 = (_ETHREAD *)KeGetCurrentThread();
  if( (*(_DWORD *)v35->Tcb.gap0 & 0x40010000) != 0 )
  {
    if( (v35->Tcb.gap0[2] & 1) != 0 )
    {
      KiCopyCounters(&v35->Tcb);
      v35 = (_ETHREAD *)KeGetCurrentThread();
    }
    if( (v35->Tcb.gap0[3] & 0x40) != 0 )
      KiUmsExit(1);
  }
  _mm_setcsr(ADJ(TrapFrame)->_MxCsr);
  if( LOWORD(ADJ(TrapFrame)->Dr7) )
    KiRestoreDebugRegisterState();
  R9 = ADJ(TrapFrame)->_R9;
  R8 = ADJ(TrapFrame)->_R8;
  __writegsbyte(0x853u, 0);
  BpbUserSpecCtrl = KeGetPcr()->Prcb.BpbUserSpecCtrl;
  if( KeGetPcr()->Prcb.BpbCurrentSpecCtrl != BpbUserSpecCtrl )
  {
    __writegsbyte(0x27Au, BpbUserSpecCtrl);
    __writemsr(0x48u, BpbUserSpecCtrl);
  }
  v39 = _bittestandreset16(MK_FP(__GS__, 632i64), 2u);
  if( v39 )
    __writemsr(0x49u, 1ui64);
  v39 = _bittestandreset16(MK_FP(__GS__, 632i64), 5u);
  if( v39 )
    __flush_rsb();
  if( (KiKvaShadow & 1) == 0 )
  {
    __swapgs();
    __iretq(retaddr, PcValue, v46, v47, v48);
  }
  KiKernelExit(ADJ(TrapFrame)->_Rcx, ADJ(TrapFrame)->_Rdx, R8, R9, v49);
  return result;
}

Referenced by: