IoWriteDeferredLiveDumpData

INT64 __stdcall IoWriteDeferredLiveDumpData(PVOID LiveDumpContext){
  __int64 v2; 
  int v3; 
  __int64 v4; 
  __int64 v5; 
  __int64 v6; 
  INT64 v7; 
  UINT64 v8; 
  __int64 v10; 
  unsigned __int64 v11; 
  struct _EVENT_DATA_DESCRIPTOR v12; 
  __int64 *v13; 
  int v14; 
  int v15; 
  unsigned __int64 *v16; 
  int v17; 
  int v18; 
  v2 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
  IopLiveDumpTraceInterfaceStart(1ui64);
  IopLiveDumpTrace((_EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_START);
  v3 = IopLiveDumpWriteDumpFile((INT64)LiveDumpContext);
  IopLiveDumpTraceDumpFileWriteEnd((__int64)LiveDumpContext, 1i64, v3);
  if( v3 >= 0 && (*((_BYTE *)LiveDumpContext + 80) & 2) != 0 )
    v3 = 261;
  IopLiveDumpTraceInterfaceEnd(v4, 1i64, v3);
  if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
  {
    v5 = *((_QWORD *)LiveDumpContext + 70);
    v15 = 0;
    v14 = 8;
    v6 = *(_QWORD *)(v5 + 4000);
    v13 = &v10;
    v10 = v6;
    v18 = 0;
    v17 = 8;
    v16 = &v11;
    v11 = (*(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v2) / 0x2710ui64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C04498,
      (unsigned __int8 *)byte_140023765,
      (const GUID *)LiveDumpContext + 54,
      (const GUID *)LiveDumpContext + 53,
      4u,
      &v12);
  }
  EtwActivityIdControl(2u, (LPGUID)LiveDumpContext + 53);
  IopLiveDumpReleaseResources((INT64)LiveDumpContext, v7, v8);
  ExFreePoolWithTag(LiveDumpContext, 0x706D644Cu);
  return(unsigned int)v3;
}

Referenced by: