sub_1403EA874

VOID __fastcall sub_1403EA874(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
  int v4; 
  unsigned __int64 v5; 
  unsigned __int64 v6; 
  char v7; 
  void **v8; 
  __int64 v9; 
  unsigned __int64 v10; 
  int v11; 
  int v12; 
  int v13; 
  void *v14; 
  void *Address[5]; 
  if( (_DWORD)a4 == 7 && (_DWORD)a3 == -1073741694 )
  {
    v4 = KeKvaShadowingActive();
    v5 = (unsigned __int64)KiSystemCall64Shadow;
    if( !v4 )
      v5 = (unsigned __int64)KiSystemCall64;
    v6 = (v5 ^ KiMismatchSummary) & 0xFFFFFFFFFFFFF000ui64;
    IoAddTriageDumpDataBlock((PVOID)v6, 0x1000ui64);
    _mm_lfence();
    MmIsAddressValid((PVOID)v6);
    if( v7 )
    {
      v8 = Address;
      v9 = 4i64;
      v10 = MmPteBase + ((v6 >> 9) & 0x7FFFFFFFF8i64);
      do
      {
        *v8++ = (void *)v10;
        v10 = MmPteBase + ((v10 >> 9) & 0x7FFFFFFFF8i64);
        --v9;
      }
      while( v9 );
      v11 = 3;
      do
      {
        v12 = v11;
        if( (_DWORD)v9 )
        {
          Address[v11] = 0i64;
        }
        else
        {
          if( !v11 )
            break;
          if( *(char *)Address[v11] < 0 )
            LODWORD(v9) = 1;
        }
        --v11;
      }
      while( v12 );
      v13 = 4;
      do
      {
        v14 = Address[v13 - 1];
        if( !v14 )
          break;
        IoAddTriageDumpDataBlock(v14, 8ui64);
        --v13;
      }
      while( v13 );
    }
    if( (unsigned int)ExQueryBigPoolTag(v6, &KiSuspectPoolTag) )
      IoAddTriageDumpDataBlock(&KiSuspectPoolTag, 4ui64);
  }
}

Referenced by: