KiDetectKvaLeakage

CHAR __fastcall KiDetectKvaLeakage(INT64 a1){
  __int64 v2; 
  __int64 v3; 
  char v4; 
  __int64 v5; 
  char v6; 
  char v7; 
  bool v8; 
  __int64 v9; 
  int v10; 
  INT64 v12[3]; 
  LODWORD(v12[0]) = 0;
  LODWORD(v2) = KiIsKvaShadowNeededForBranchConfusion(a1);
  if( (_DWORD)v2 )
    goto LABEL_19;
  LODWORD(v2) = *(unsigned __int8 *)(a1 + 141);
  if( (_BYTE)v2 == 2 )
  {
    if( *(_BYTE *)(a1 + 64) == 6 )
    {
      v2 = *(unsigned __int8 *)(a1 + 67);
      if( (unsigned __int8)v2 <= 0x36u )
      {
        v3 = 0x6000C010000000i64;
        if( _bittest64(&v3, v2) )
          return v2;
      }
    }
  }
  else if( (_BYTE)v2 != 3 || *(_BYTE *)(a1 + 64) == 6 && *(_BYTE *)(a1 + 67) == 13 )
  {
    return v2;
  }
  LODWORD(v2) = EAX(__cpuid(0, 0));
  v4 = 0;
  if( (unsigned int)v2 < 7 )
    goto LABEL_18;
  v5 = __cpuid(7, 0);
  LOBYTE(v2) = EAX(v5);
  if( (EDX(v5) & 0x20000000) != 0 )
  {
    v2 = __readmsr(0x10Au);
    v4 = v2;
  }
  if( (v4 & 1) == 0 )
    goto LABEL_18;
  KiMicrocodeTrackerEnabled = 1;
  LOBYTE(v2) = 0;
  v6 = (KeFeatureBits2 & 0x28) == 8;
  if( (KeFeatureBits2 & 0x380000) != 3670016 )
  {
    LOBYTE(v2) = KiIsFbClearSupported();
    v6 = v2 | v7;
  }
  if( v6 )
  {
LABEL_18:
    if( *(_DWORD *)(a1 + 36) && !KiKvaLeakage )
      KeBugCheckEx(0x5Du, 0x4B56414Cui64, 0i64, 0i64, 0i64);
LABEL_19:
    v8 = *(_BYTE *)(a1 + 141) == 2;
    KiKvaLeakage = 1;
    if( !v8 || (KeFeatureBits2 & 0x10) != 0 )
    {
      if( !*(_DWORD *)(a1 + 36) )
        KiImplementedPhysicalBits = -1;
    }
    else
    {
      LOBYTE(v2) = HvlGetImplementedPhysicalBits(v12);
      if( (_BYTE)v2 )
      {
        v10 = v12[0];
      }
      else
      {
        v9 = 0i64;
        v2 = 0i64;
        v10 = 46;
        while( *(int *)((char *)KiCpuTable + v2) != *(unsigned __int8 *)(a1 + 141)
             || *(int *)((char *)&KiCpuTable[1] + v2) != *(_DWORD *)(a1 + 1736) )
        {
          ++v9;
          v2 = 20 * v9;
          if( KiCpuTable[5 * v9 + 2] == 19 )
            goto LABEL_33;
        }
        LOBYTE(v2) = 5 * v9;
        v10 = KiCpuTable[5 * v9 + 3];
        if( !v10 )
        {
          if( (unsigned int)EAX(__cpuid(0x80000000, 0)) < 0x80000008 )
            LOBYTE(v2) = 36;
          else
            LOBYTE(v2) = EAX(__cpuid(-2147483640, 0));
          v10 = (unsigned __int8)v2;
        }
      }
LABEL_33:
      if( *(_DWORD *)(a1 + 36) )
      {
        LOBYTE(v2) = KiImplementedPhysicalBits;
        if( v10 != KiImplementedPhysicalBits && !KiKvaLeakageSimulate )
          KeBugCheckEx(0x5Du, 0x4C315446ui64, *(unsigned int *)(a1 + 36), v10, KiImplementedPhysicalBits);
      }
      else
      {
        KiImplementedPhysicalBits = v10;
      }
    }
  }
  return v2;
}

Referenced by: