sub_1403EA874

void __fastcall sub_1403EA874(__int64 a1, __int64 a2, int a3, int a4){
  NTSTATUS v4; 
  unsigned __int64 v5; 
  unsigned __int64 v6; 
  VOID **v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  int v10; 
  int v11; 
  int v12; 
  VOID *v13; 
  VOID *Address[5]; 

  if( a4 == 7 && a3 == -1073741694 )
  {
    v4 = KeKvaShadowingActive();
    v5 = (unsigned __int64)KiSystemCall64Shadow;
    if( !v4 )
      v5 = (unsigned __int64)KiSystemCall64;
    v6 = (v5 ^ *(&SbiVmbusArrivalEvent + 364)) & 0xFFFFFFFFFFFFF000ui64;
    IoAddTriageDumpDataBlock((VOID *)v6, (_BYTE *)0x1000);
    _mm_lfence();
    if( MmIsAddressValid(v6) )
    {
      v7 = Address;
      v8 = 4i64;
      v9 = MmPteBase + ((v6 >> 9) & 0x7FFFFFFFF8i64);
      do
      {
        *v7++ = (VOID *)v9;
        v9 = MmPteBase + ((v9 >> 9) & 0x7FFFFFFFF8i64);
        --v8;
      }
      while( v8 );
      v10 = 3;
      do
      {
        v11 = v10;
        if( (_DWORD)v8 )
        {
          Address[v10] = 0i64;
        }
        else
        {
          if( !v10 )
            break;
          if( *(char *)Address[v10] < 0 )
            LODWORD(v8) = 1;
        }
        --v10;
      }
      while( v11 );
      v12 = 4;
      do
      {
        v13 = Address[v12 - 1];
        if( !v13 )
          break;
        IoAddTriageDumpDataBlock(v13, (_BYTE *)8);
        --v12;
      }
      while( v12 );
    }
    if( (unsigned int)ExQueryBigPoolTag(v6, (_DWORD *)&SbiVmbusArrivalEvent + 730) )
      IoAddTriageDumpDataBlock((char *)&SbiVmbusArrivalEvent + 2920, (_BYTE *)4);
  }
}

Referenced by: