KiMcheckAbortShadow

VOID __stdcall KiMcheckAbortShadow(UINT64 a1, UINT64 a2, UINT64 a3, UINT64 a4){
  unsigned __int64 v4; 
  unsigned __int64 v5; 
  unsigned __int64 retaddr; 
  __readmsr(0xC0000101);
  __writemsr(0xC0000101, retaddr);
  v4 = __readcr3();
  v5 = *((_QWORD *)KeGetPcr() + 4608);
  if( v4 != v5 && !_bittest(MK_FP(__GS__, 36888i64), 1u) )
    __writecr3(v5);
  KiMcheckAbort(a1, a2, a3, a4);
}

Referenced by:

No references.