IopLiveDumpValidateParameters
VOID __fastcall IopLiveDumpValidateParameters(UINT64 a1, INT64 a2, INT64 a3){
__int64 v3;
unsigned int v6;
__int64 v7;
int v8;
unsigned int v9;
__int64 v10;
v3 = 0i64;
if( a2 )
{
if( *(_DWORD *)a2 == 1 && *(_DWORD *)(a2 + 4) >= 0x30u )
{
v6 = *(_DWORD *)(a2 + 28);
if( v6 < 2 )
{
*(_DWORD *)(a1 + 44) = v6;
if( !*(_QWORD *)(a2 + 32) )
{
v7 = *(_QWORD *)(a2 + 40);
v8 = 0;
while( v7 )
{
if( *(_DWORD *)(v7 + 28) )
return;
if( !*(_QWORD *)(v7 + 16) || !*(_DWORD *)(v7 + 24) )
{
v8 = -1073741811;
break;
}
v7 = *(_QWORD *)(v7 + 32);
}
if( v8 >= 0 )
{
*(_OWORD *)(a1 + 48) = *(_OWORD *)(a2 + 32);
v9 = *(_DWORD *)(a2 + 24);
if( v9 < 0x20 && (v9 & 3) == 0 )
{
*(_DWORD *)(a1 + 40) = v9;
if( (int)IopLiveDumpValidateDumpFileHandle(*(PVOID *)(a2 + 8)) < 0 )
{
*(_QWORD *)(a1 + 64) = 0i64;
}
else
{
*(_QWORD *)(a1 + 64) = *(_QWORD *)(a2 + 8);
if( (int)IopLiveDumpValidateCancelObject(*(PVOID *)(a2 + 16)) >= 0 )
v3 = v10;
*(_QWORD *)(a1 + 72) = v3;
}
}
}
}
}
}
}
}Referenced by:
IoCaptureLiveDump