IopCalculateStackInformation
CHAR __stdcall IopCalculateStackInformation(INT64 a1, INT64 a2, UINT64 *a3, UINT64 *a4){
CHAR v4;
UINT64 v7;
UINT64 v8;
UINT64 v9;
_QWORD *DpcStack;
UINT64 v11;
unsigned int v12;
VOID *v13;
int v14;
v4 = 0;
if( a1 && (*(_DWORD *)(a1 + 120) & 0x20000) != 0 )
{
v7 = *(_QWORD *)(a2 + 152);
v8 = *(_QWORD *)(a1 + 48);
v9 = *(_QWORD *)(a1 + 56);
if( v8 > v7 || v7 >= v9 )
{
*a3 = *(_QWORD *)(a1 + 48);
if( (KeGetPcr()->Prcb.DpcRequestSummary & 1) != 0 && (_ETHREAD *)a1 != KeGetCurrentPrcb()->IdleThread )
{
DpcStack = KeGetPcr()->Prcb.DpcStack;
if( KiIsAddressRangeValid((INT64)DpcStack, 80i64) )
{
v11 = DpcStack[8];
if( v8 <= v11 && v11 < v9 )
*a3 = v11;
}
}
}
else
{
*a3 = v7;
}
v12 = v9 - *(_DWORD *)a3;
v13 = (VOID *)*a3;
*(_DWORD *)a4 = v12;
IopGetMaxValidMemorySize(v13, v12);
*(_DWORD *)a4 = v14;
if( *a3 && v14 )
return 1;
}
return v4;
}Referenced by:
IopAddMiniDumpPagesToPartialKernelDump