IopConstructInMemoryDumpHeader
VOID __stdcall IopConstructInMemoryDumpHeader(INT64 a1, _BYTE *a2){
_DWORD *v2;
__int64 v3;
if( _InterlockedExchange(dword_140C50910, 1) != 1 )
{
dword_140C50948 = 0;
if( dword_140C50914
&& (v2 = *(_DWORD **)&dword_140C50910[2 * (dword_140C50930[0] & 1) + 2]) != 0i64
&& (v3 = *(_QWORD *)&dword_140C50910[2 * ((LOBYTE(dword_140C50930[0]) - 1) & 1) + 2]) != 0 )
{
IoFillDumpHeader((VOID *)(v3 + 24), 1ui64, 0x14Cui64, 0i64, 0i64, 0i64, 0i64, KeGetCurrentThread());
*(_QWORD *)(v3 + 4040) = qword_140C50938;
*(_QWORD *)(v3 + 40) = PsInitialSystemProcess->Pcb.DirectoryTableBase & 0xFFFFFFFFFFFFF000ui64;
*v2 = _InterlockedExchange((volatile __int32 *)v3, 1397967163);
++dword_140C50930[0];
}
else
{
dword_140C50948 = -1073741823;
}
_InterlockedExchange(dword_140C50910, 0);
}
}Referenced by:
IoUpdateDumpPhysicalRanges
IopInitializeOfflineCrashDump