KiMcheckAbortShadow

VOID __stdcall KiMcheckAbortShadow(
        _XSTATE_CONFIGURATION *a1,
        _XSTATE_CONFIGURATION *a2,
        _XSTATE_CONFIGURATION *a3,
        _XSTATE_CONFIGURATION *a4){
  unsigned __int64 v4; 
  unsigned __int64 KernelDirectoryTableBase; 
  unsigned __int64 retaddr; 

  __readmsr(0xC0000101);
  __writemsr(0xC0000101, retaddr);
  v4 = __readcr3();
  KernelDirectoryTableBase = KeGetPcr()->Prcb.KernelDirectoryTableBase;
  if( v4 != KernelDirectoryTableBase && !_bittest(MK_FP(__GS__, 36888i64), 1u) )
    __writecr3(KernelDirectoryTableBase);
  KiMcheckAbort((UINT64)a1, (UINT64)a2, (UINT64)a3, (UINT64)a4);
}

Referenced by: