IoFillDumpHeader

VOID __stdcall IoFillDumpHeader(
        VOID *DumpHeader,
        UINT64 DumpType,
        UINT64 BugCheckCode,
        UINT64 BugCheckParameter1,
        UINT64 BugCheckParameter2,
        UINT64 BugCheckParameter3,
        UINT64 BugCheckParameter4,
        _KTHREAD *Thread){
  int v8; 
  char *v10; 
  unsigned __int64 v11; 
  unsigned __int64 DirectoryTableBase; 
  unsigned __int64 v13; 
  PHYSICAL_MEMORY_RANGE *PhysicalMemoryRanges; 
  PHYSICAL_MEMORY_RANGE *v15; 
  __int64 v16; 
  LARGE_INTEGER *p_NumberOfBytes; 
  LARGE_INTEGER NumberOfBytes; 
  __int64 v19; 
  char *v20; 
  unsigned __int64 QuadPart; 
  unsigned int BootId; 

  v8 = DumpType;
  v10 = (char *)DumpHeader;
  v11 = 2048i64;
  if( ((unsigned __int8)DumpHeader & 4) != 0 )
  {
    *(_DWORD *)DumpHeader = 1162297680;
    v10 = (char *)DumpHeader + 4;
    v11 = 2047i64;
  }
  memset64(v10, 0x4547415045474150ui64, v11 >> 1);
  if( (v11 & 1) != 0 )
    *(_DWORD *)&v10[4 * v11 - 4] = 1162297680;
  *((_QWORD *)DumpHeader + 9) = BugCheckParameter2;
  *((_QWORD *)DumpHeader + 10) = BugCheckParameter3;
  *((_QWORD *)DumpHeader + 11) = BugCheckParameter4;
  *((_DWORD *)DumpHeader + 1) = 875976004;
  *((_DWORD *)DumpHeader + 14) = BugCheckCode;
  *((_QWORD *)DumpHeader + 8) = BugCheckParameter1;
  if( Thread )
    DirectoryTableBase = Thread->Tcb.ApcState.Process->Pcb.DirectoryTableBase;
  else
    DirectoryTableBase = __readcr3();
  *((_QWORD *)DumpHeader + 2) = DirectoryTableBase & 0xFFFFFFFFFFFFF000ui64;
  *((_DWORD *)DumpHeader + 12) = 34404;
  *((_DWORD *)DumpHeader + 998) = DumpType;
  *((_QWORD *)DumpHeader + 3) = MmPfnDatabase;
  *((_QWORD *)DumpHeader + 4) = &PsLoadedModuleList;
  *((_QWORD *)DumpHeader + 5) = &PsActiveProcessHead;
  *((_QWORD *)DumpHeader + 16) = &KdDebuggerDataBlock;
  *((_DWORD *)DumpHeader + 13) = KeQueryActiveProcessorCountEx(0xFFFFu);
  *((_DWORD *)DumpHeader + 2) = (unsigned int)NtBuildNumber >> 28;
  *((_DWORD *)DumpHeader + 3) = (unsigned __int16)NtBuildNumber;
  if( (unsigned int)(v8 - 5) <= 1 || !MmPhysicalMemoryBlock )
    goto LABEL_24;
  if( KeGetCurrentIrql() > 1u )
  {
    v13 = 16 * (MmPhysicalMemoryBlock->NumberOfRuns - 1 + 2i64);
    if( v13 > 0x2BC )
      LODWORD(v13) = 700;
    memmove((char *)DumpHeader + 136, MmPhysicalMemoryBlock, v13);
    goto LABEL_25;
  }
  PhysicalMemoryRanges = MmGetPhysicalMemoryRanges();
  v15 = PhysicalMemoryRanges;
  if( !PhysicalMemoryRanges )
  {
LABEL_24:
    memset((char *)DumpHeader + 136, 0i64, 0x2BCu);
    goto LABEL_25;
  }
  v16 = 0i64;
  p_NumberOfBytes = &PhysicalMemoryRanges->NumberOfBytes;
  NumberOfBytes = PhysicalMemoryRanges->NumberOfBytes;
  v19 = 0i64;
  while( NumberOfBytes.QuadPart )
  {
    v16 = (unsigned int)(v16 + 1);
    v19 += (unsigned __int64)NumberOfBytes.QuadPart >> 12;
    NumberOfBytes = PhysicalMemoryRanges[(unsigned int)v16].NumberOfBytes;
  }
  *((_QWORD *)DumpHeader + 18) = v19;
  if( 16 * ((unsigned __int64)(unsigned int)(v16 - 1) + 2) > 0x2BC )
    v16 = 42i64;
  *((_DWORD *)DumpHeader + 34) = v16;
  if( (_DWORD)v16 )
  {
    v20 = (char *)((_BYTE *)DumpHeader - (_BYTE *)PhysicalMemoryRanges);
    do
    {
      *(LONGLONG *)((char *)&p_NumberOfBytes[18].QuadPart + (_QWORD)v20) = (unsigned __int64)p_NumberOfBytes[-1].QuadPart >> 12;
      QuadPart = p_NumberOfBytes->QuadPart;
      p_NumberOfBytes += 2;
      *(LONGLONG *)((char *)&p_NumberOfBytes[17].QuadPart + (_QWORD)v20) = QuadPart >> 12;
      --v16;
    }
    while( v16 );
  }
  ExFreePoolWithTag(v15, 0);
LABEL_25:
  memset((char *)DumpHeader + 840, 0i64, 0xBB8u);
  *((_QWORD *)DumpHeader + 481) = 0i64;
  *((_DWORD *)DumpHeader + 966) = 0;
  *((_QWORD *)DumpHeader + 482) = 0i64;
  *((_DWORD *)DumpHeader + 960) = -2147483645;
  *((_DWORD *)DumpHeader + 961) = 1;
  *((_DWORD *)DumpHeader + 1002) = KUSER_SHARED_DATA.SystemTime.LowPart;
  *((_DWORD *)DumpHeader + 1003) = KUSER_SHARED_DATA.SystemTime.High1Time;
  *((_DWORD *)DumpHeader + 1036) = KUSER_SHARED_DATA.InterruptTime.LowPart;
  *((_DWORD *)DumpHeader + 1037) = KUSER_SHARED_DATA.InterruptTime.High1Time;
  RtlGetNtProductType((_NT_PRODUCT_TYPE *)DumpHeader + 1040);
  *((_DWORD *)DumpHeader + 1041) = KUSER_SHARED_DATA.SuiteMask;
  BootId = KUSER_SHARED_DATA.BootId;
  *((_DWORD *)DumpHeader + 1044) = 0;
  *((_DWORD *)DumpHeader + 1045) = BootId;
}

Referenced by: