IopLiveDumpTraceCaptureMemoryPages
NTSTATUS __stdcall IopLiveDumpTraceCaptureMemoryPages(){
NTSTATUS result;
__int64 v1;
UINT64 UserDataCount;
EVENT_DATA_DESCRIPTOR UserData;
__int64 v4;
__int64 v5;
__int64 v6;
__int64 v7;
__int64 v8;
__int64 v9;
__int64 v10;
__int64 v11;
__int64 v12;
__int64 v13;
__int64 v14;
__int64 v15;
LOBYTE(result) = IopLiveDumpIsTracingEnabled();
if( (_BYTE)result )
{
*(_QWORD *)&UserData.Size = 8i64;
UserData.Ptr = v1 + 480;
v5 = 8i64;
v4 = v1 + 488;
v7 = 8i64;
v6 = v1 + 496;
v8 = v1 + 512;
v10 = v1 + 520;
v12 = v1 + 528;
v14 = v1 + 536;
LODWORD(UserDataCount) = 7;
v9 = 8i64;
v11 = 8i64;
v13 = 8i64;
v15 = 8i64;
return EtwWriteEx(
IopLiveDumpEtwRegHandle,
(EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_CAPTURE_WORKFLOW_CAPTURE_MEMORY_PAGES,
0i64,
0i64,
0i64,
0i64,
UserDataCount,
&UserData);
}
return result;
}Referenced by:
IopLiveDumpCaptureMemoryPages