MmGetPageFileForCrashDump

INT64 __fastcall MmGetPageFileForCrashDump(){
  _ETHREAD *CurrentThread; 
  INT64 v1; 
  unsigned __int64 v2; 
  __int64 *v3; 
  __int64 v4; 
  __int64 v5; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v1 = 0i64;
  v2 = 0i64;
  --*((_WORD *)CurrentThread + 243);
  ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50ED0, 0i64);
  if( Count )
  {
    v3 = qword_140C525E0;
    v4 = Count;
    do
    {
      v5 = *v3;
      if( (*(_WORD *)(*v3 + 204) & 0x850) == 0 && *(_QWORD *)(v5 + 16) > v2 )
      {
        v1 = *(_QWORD *)(v5 + 224);
        v2 = *(_QWORD *)(v5 + 16);
      }
      ++v3;
      --v4;
    }
    while( v4 );
  }
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50ED0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&qword_140C50ED0);
  KeAbPostRelease(&qword_140C50ED0);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return v1;
}

Referenced by: