LkmdTelCreateReport

HANDLE __stdcall LkmdTelCreateReport(
        PWCHAR ReportType,
        UINT32 BugCheckCode,
        PVOID BugCheckParam1,
        PVOID BugCheckParam2,
        PVOID BugCheckParam3,
        PVOID BugCheckParam4){
  char *PoolWithTag; 
  char *v9; 
  VOID *v10; 
  int v11; 
  int v12; 
  int v13; 
  int v14; 
  int v15; 
  __int64 v17; 
  __int64 v18; 
  CONTEXT ContextRecord; 
  memset((INT64)&ContextRecord, 0i64);
  v18 = 0i64;
  LODWORD(v17) = 0;
  PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x88ui64, 0x74614454ui64);
  v9 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    v10 = ExAllocatePoolWithTag(NonPagedPoolNx, 0x40000ui64, 0x74614454ui64);
    *(_QWORD *)v9 = v10;
    if( v10 && (int)RtlStringCbPrintfW((WCHAR *)v9 + 52, 0x20ui64, (WCHAR *)L"%ws") >= 0 )
    {
      LODWORD(v17) = 1;
      v11 = WerLiveKernelCreateReport(v9 + 104, &v17, &v18);
      v12 = v11;
      if( v11 < 0 )
      {
        DbgPrintEx(5u, 0, "LKMDTEL: WerLiveKernelCreateReport failed with status 0x%X\n", (unsigned int)v11);
        goto LABEL_10;
      }
      if( (_DWORD)v17 )
      {
        *((_QWORD *)v9 + 12) = v18;
        RtlCaptureContext(&ContextRecord);
        v13 = KeCapturePersistentThreadState(
                (__int64)&ContextRecord,
                0i64,
                292,
                (__int64)BugCheckParam1,
                (__int64)BugCheckParam2,
                (__int64)BugCheckParam3,
                (__int64)BugCheckParam4,
                *(_QWORD *)v9);
        if( v13 )
        {
          *((_DWORD *)v9 + 2) = v13;
LABEL_10:
          if( v12 >= 0 )
            return v9;
        }
      }
      else
      {
        DbgPrintEx(5u, 1u, "LKMDTEL: WerPolicy is WerLiveKernelPolicyNoDump, no dump is allowed.\n");
      }
    }
    if( *(_QWORD *)v9 )
      ExFreePoolWithTag(*(PVOID *)v9, 0x74614454u);
    ExFreePoolWithTag(v9, 0x74614454u);
    v9 = 0i64;
  }
  if( v18 )
  {
    v14 = WerLiveKernelCancelReport();
    if( v14 < 0 )
      DbgPrintEx(5u, 1u, "LKMDTEL: WerLiveCancelReport failed, status 0x%X\n", (unsigned int)v14);
    v15 = WerLiveKernelCloseHandle(v18);
    if( v15 < 0 )
      DbgPrintEx(5u, 1u, "LKMDTEL: WerLiveCancelReport failed, status 0x%X\n", (unsigned int)v15);
  }
  return v9;
}

Referenced by: