MiCheckSystemPageTables

INT64 __stdcall MiCheckSystemPageTables(UINT64 *FaultStatus){
  __int64 v2; 
  ULONG_PTR **i; 
  ULONG_PTR v4; 
  UINT64 v6; 
  unsigned int v7; 
  int v8; 
  ULONG_PTR v9; 
  v2 = 3i64;
  for( i = (ULONG_PTR **)(FaultStatus + 6); ; --i )
  {
    v4 = **i;
    if( (v4 & 1) == 0 )
      KeBugCheckEx(0x50u, *FaultStatus, FaultStatus[1], FaultStatus[2], 0xDui64);
    if( (v4 & 0x80u) != 0i64 )
      break;
    if( !--v2 )
      return 0i64;
  }
  if( (FaultStatus[1] & 2) == 0 || (v4 & 0x800) != 0 )
  {
    MiCheckSystemNxFault((INT64)FaultStatus, v4, 6ui64);
    v6 = FaultStatus[2];
    if( (v6 & 1) != 0 )
    {
      v7 = *(unsigned __int8 *)(v6 & 0xFFFFFFFFFFFFFFFEui64);
      if( (unsigned __int8)v7 <= 6u )
      {
        v8 = 74;
        if( _bittest(&v8, v7) )
          return 1i64;
      }
    }
    else if( KeInvalidAccessAllowed((PVOID)v6) == 1 )
    {
      return 1i64;
    }
    v9 = *FaultStatus;
    if( *FaultStatus >= (unsigned __int64)MmGetPteBase() && v9 <= (unsigned __int64)MmGetPteLimit() )
      KeBugCheckEx(0x50u, v9, FaultStatus[1], FaultStatus[2], 8ui64);
    return 1i64;
  }
  if( !MiGenerateAccessViolation(FaultStatus) )
    KeBugCheckEx(0xBEu, *FaultStatus, v4, FaultStatus[2], 0x10ui64);
  return 2i64;
}

Referenced by: