MiRaisedIrqlFault

NTSTATUS __stdcall MiRaisedIrqlFault(
        UINT64 FaultStatus,
        PVOID VirtualAddress,
        PVOID TrapInformation,
        _MMPTE **PteHierarchy){
  void *v5; 
  __int64 v6; 
  ULONG_PTR v7; 
  unsigned __int64 PdeBase; 
  unsigned __int64 PdeLimit; 
  _MMPTE *PteBase; 
  _BYTE *v12; 
  ULONG_PTR v13; 
  __int64 v14; 
  INT64 *i; 
  INT64 v16; 
  volatile signed __int64 *v17; 
  INT64 v18; 
  unsigned __int64 v19; 
  __int64 v20; 
  _MMPFN *PfnDb; 
  unsigned __int64 v22; 
  INT64 a2; 
  v5 = *(void **)(FaultStatus + 16);
  if( ((unsigned __int8)v5 & 1) == 0 && KeInvalidAccessAllowed(v5) == 1 )
    return -1073741819;
  if( (*(_DWORD *)(FaultStatus + 80) & 0x20) != 0 )
    KeBugCheckEx(0x50u, *(_QWORD *)FaultStatus, *(_QWORD *)(FaultStatus + 8), *(_QWORD *)(FaultStatus + 16), 0xEui64);
  v6 = *((_QWORD *)KeGetCurrentPrcb() + 4095);
  if( v6 && *(_DWORD *)(v6 + 12480) )
  {
    v7 = *(_QWORD *)FaultStatus;
    if( KeGetCurrentIrql() != 2 )
      KeBugCheckEx(0x50u, v7, *(_QWORD *)(FaultStatus + 8), KeGetCurrentIrql(), 0xAui64);
    PdeBase = (unsigned __int64)MmGetPdeBase();
    PdeLimit = (unsigned __int64)MmGetPdeLimit();
    if( v7 < PdeBase || v7 > PdeLimit )
    {
      PteBase = MmGetPteBase();
      if( (v7 < (unsigned __int64)PteBase + ((PdeBase >> 9) & 0x7FFFFFFFF8i64)
         || v7 > (unsigned __int64)PteBase + ((PdeLimit >> 9) & 0x7FFFFFFFF8i64))
        && (v7 < PdeBase + ((PdeBase >> 18) & 0x3FFFFFF8) || v7 > PdeBase + ((PdeLimit >> 18) & 0x3FFFFFF8)) )
      {
        KeBugCheckEx(0x50u, v7, *(_QWORD *)(FaultStatus + 8), *(_QWORD *)(FaultStatus + 16), 0xBui64);
      }
    }
    return -1073741819;
  }
  v12 = (_BYTE *)(*(_QWORD *)(FaultStatus + 16) & 0xFFFFFFFFFFFFFFFEui64);
  if( (*(_QWORD *)(FaultStatus + 16) & 1i64) != 0 && *v12 == 1 )
    return -1073741819;
  if( (*(_QWORD *)(FaultStatus + 16) & 1i64) == 0 )
  {
    if( KeInvalidAccessAllowed(*(PVOID *)(FaultStatus + 16)) != 1 )
      goto LABEL_24;
    return -1073741819;
  }
  if( *v12 == 3 || *v12 == 6 )
    return -1073741819;
LABEL_24:
  if( MiTransientCombineAddress((unsigned __int64)KeGetCurrentThread(), *(_QWORD *)FaultStatus) )
    return -1073741819;
  v13 = *(_QWORD *)FaultStatus;
  if( *(_QWORD *)FaultStatus >= 0xFFFF800000000000ui64 )
  {
    v14 = 3i64;
    for( i = (INT64 *)(FaultStatus + 48); ; --i )
    {
      v16 = MI_READ_PTE_LOCK_FREE(*i);
      if( (v16 & 1) == 0 )
        goto LABEL_36;
      if( (v16 & 0x80u) != 0i64 )
      {
        if( (*(_BYTE *)(FaultStatus + 8) & 2) != 0 && (v16 & 0x800) == 0 )
          KeBugCheckEx(0xBEu, v13, v16, *(_QWORD *)(FaultStatus + 16), 0xFui64);
        MiCheckSystemNxFault(FaultStatus, v16, 3ui64);
        v22 = *(_QWORD *)FaultStatus;
        if( *(_QWORD *)FaultStatus >= (unsigned __int64)MmGetPteBase() && v22 <= (unsigned __int64)MmGetPteLimit() )
          KeBugCheckEx(0x50u, v22, *(_QWORD *)(FaultStatus + 8), *(_QWORD *)(FaultStatus + 16), 8ui64);
        return 0;
      }
      if( !v14 )
        break;
      --v14;
    }
    v17 = (volatile signed __int64 *)((char *)MmGetPteBase() + ((v13 >> 9) & 0x7FFFFFFFF8i64));
    v18 = MI_READ_PTE_LOCK_FREE((INT64)v17);
    a2 = v18;
    v19 = v18;
    if( (v18 & 1) != 0 )
    {
      if( (*(_BYTE *)(FaultStatus + 8) & 2) != 0 )
      {
        if( (v18 & 0x200) != 0 )
          return -805306362;
        if( (v18 & 0x800) == 0 )
          KeBugCheckEx(0xBEu, v13, v18, *(_QWORD *)(FaultStatus + 16), 0xAui64);
      }
      MiCheckSystemNxFault(FaultStatus, a2, 0i64);
      MiPteInShadowRange((UINT64)&a2);
      v20 = (v19 >> 12) & 0xFFFFFFFFFi64;
      PfnDb = MmGetPfnDb();
      if( *((_WORD *)PfnDb + 24 * v20 + 16) > 1u
        || (*((_BYTE *)PfnDb + 48 * v20) & 1) == 0
        || (*((_BYTE *)PfnDb + 48 * v20 + 35) & 8) != 0 )
      {
        MiNoFaultFound(FaultStatus, v17, *(_QWORD *)FaultStatus, *(_QWORD *)(FaultStatus + 16), 1u, a2);
        return 0;
      }
    }
LABEL_36:
    if( MiGenerateAccessViolation((UINT64 *)FaultStatus) )
      return -1073741819;
  }
  return -805306362;
}

Referenced by: