MiCheckKernelShadow

NTSTATUS __stdcall MiCheckKernelShadow(CHAR a1, UINT64 a2, INT64 a3){
  _MMPTE *PteBase; 
  char *v5; 
  unsigned __int64 v6; 
  NTSTATUS v7; 
  __int64 v8; 
  UINT64 v9; 
  UINT64 BugCheckParameter4; 
  __int64 v11; 
  UINT64 v14; 
  __int64 v15; 

  PteBase = MmGetPteBase();
  v5 = (char *)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64);
  v6 = (unsigned __int64)PteBase + (((a2 + a3 - 1) >> 9) & 0x7FFFFFFFF8i64);
  v7 = -1;
  v8 = 0i64;
  while( (unsigned __int64)v5 <= v6 )
  {
    v9 = MiReadWriteAnyLevelShadowPte((unsigned __int64)v5, 0, 0, ZeroPte.u.Long);
    v14 = v9;
    BugCheckParameter4 = v9;
    if( (v9 & 1) == 0 )
    {
      if( (a1 & 8) == 0 )
        KeBugCheckEx(0x1Au, (PVOID)0x3602, v5, (PVOID)v9, (PVOID)v9);
      return v8 + a2;
    }
    LODWORD(v11) = MiVaToPfn((VOID *)(v8 + a2));
    v15 = v11;
    MiPteInShadowRange((UINT64)&v14);
    if( v15 != ((BugCheckParameter4 >> 12) & 0xFFFFFFFFFi64) )
    {
      if( (a1 & 8) == 0 )
        KeBugCheckEx(0x1Au, (PVOID)0x3603, v5, (PVOID)BugCheckParameter4, (PVOID)BugCheckParameter4);
      return v8 + a2;
    }
    v5 += 8;
    v8 += 4096i64;
  }
  return v7;
}

Referenced by: