IopLiveDumpTraceDumpFileWriteEnd
VOID __stdcall IopLiveDumpTraceDumpFileWriteEnd(_LIVEDUMP_CONTEXT *Context, UINT64 Interface, INT64 Status){
int v3;
__int64 v4;
bool v5;
_QWORD *v6;
const _EVENT_DESCRIPTOR *v7;
__int64 v8;
__int64 v9;
__int64 v10;
__int64 v11;
__int64 v12;
__int64 v13;
_EVENT_DATA_DESCRIPTOR UserData;
__int64 *v15;
__int64 v16;
__int64 *v17;
__int64 v18;
__int64 *v19;
__int64 v20;
__int64 *v21;
__int64 v22;
int v23;
v23 = Status;
if( IopLiveDumpIsTracingEnabled() )
{
v5 = v3 == 0;
v6 = *(_QWORD **)(v4 + 560);
v7 = (const _EVENT_DESCRIPTOR *)LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_END;
if( !v5 )
v7 = &LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_END;
if( v23 < 0 )
{
v10 = 0i64;
v9 = 0i64;
v11 = 0i64;
v8 = 0i64;
}
else
{
v10 = v6[500];
v11 = v6[1028];
v8 = v6[1029] << 12;
v9 = v10 - v8 - v11;
}
v12 = v8;
UserData.Ptr = (unsigned __int64)&v23;
v13 = v9;
v15 = &v10;
v17 = &v11;
v19 = &v12;
v21 = &v13;
*(_QWORD *)&UserData.Size = 4i64;
v16 = 8i64;
v18 = 8i64;
v20 = 8i64;
v22 = 8i64;
EtwWriteEx(*(&stru_140CF2E80 + 602), v7, 0i64, 0, 0, 0, 5u, &UserData);
}
}Referenced by:
IoCaptureLiveDump
IoWriteDeferredLiveDumpData