MiCheckShadowStackOverflow

__int64 __fastcall MiCheckShadowStackOverflow(UINT64 a1, _DWORD *a2){
  unsigned int v2; 
  __int64 v6; 
  void *v7; 
  unsigned __int64 v8; 
  VOID *v9; 
  UINT64 AllocationType; 
  UINT64 Protect; 
  VOID *BaseAddress; 
  INT64 v13; 
  UINT64 RegionSize; 

  BaseAddress = 0i64;
  v2 = 0;
  RegionSize = 0i64;
  if( (MiFlags & 0x2000000) != 0 )
  {
    LODWORD(v6) = MiObtainReferencedVadEx(a1, 2, &v13);
    v7 = (void *)v6;
    if( v6 )
    {
      if( (*(_DWORD *)(v6 + 48) & 0x5100000) == 68157440 )
      {
        v2 = 1;
        v8 = (*(unsigned int *)(v6 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v6 + 32) << 32)) << 12;
        MiUnlockAndDereferenceVadShared((PVOID)v6);
        *a2 = -1073741571;
        v7 = 0i64;
        v9 = (VOID *)((a1 & 0xFFFFFFFFFFFFF000ui64) - 4096);
        RegionSize = 4096i64;
        BaseAddress = v9;
        if( (unsigned __int64)v9 > a1 )
          return v2;
        if( (unsigned __int64)v9 <= v8 )
          return v2;
        LODWORD(Protect) = 258;
        LODWORD(AllocationType) = 4096;
        if( ZwAllocateVirtualMemory(
               (VOID *)0xFFFFFFFFFFFFFFFFi64,
               &BaseAddress,
               0i64,
               &RegionSize,
               AllocationType,
               Protect) < 0 )
          return v2;
        *a2 = 275;
      }
      if( v7 )
        MiUnlockAndDereferenceVadShared(v7);
    }
  }
  return v2;
}

Referenced by: