DbgkpWerWriteSecondaryData
NTSTATUS __fastcall DbgkpWerWriteSecondaryData(INT64 a1, VOID *a2){
__int64 v2;
NTSTATUS result;
ULONG Length;
struct _IO_STATUS_BLOCK IoStatusBlock;
int Buffer[4];
ULONG i;
__int128 v9;
int v10;
int v11;
int v12;
v2 = *(_QWORD *)(a1 + 168);
IoStatusBlock = 0i64;
if( !v2 )
return 0;
Buffer[3] = NtBuildNumber;
Buffer[2] = 16;
Buffer[0] = 1886221636;
Buffer[1] = 1651469378;
result = ZwWriteFile(a2, 0i64, 0i64, 0i64, &IoStatusBlock, Buffer, 0x10u, 0i64, 0i64);
if( result >= 0 )
{
v11 = 0;
Length = 32;
v12 = 0;
for( i = 32; ; Length = i )
{
v9 = *(_OWORD *)v2;
v10 = *(_DWORD *)(v2 + 24);
result = ZwWriteFile(a2, 0i64, 0i64, 0i64, &IoStatusBlock, &i, Length, 0i64, 0i64);
if( result < 0 )
break;
result = ZwWriteFile(a2, 0i64, 0i64, 0i64, &IoStatusBlock, *(PVOID *)(v2 + 16), *(_DWORD *)(v2 + 24), 0i64, 0i64);
if( result < 0 )
break;
v2 = *(_QWORD *)(v2 + 32);
if( !v2 )
break;
}
}
return result;
}Referenced by:
DbgkpWerWriteTriageDump