IopInitCrashDumpDuringSysInit
NTSTATUS __stdcall IopInitCrashDumpDuringSysInit(_LOADER_PARAMETER_BLOCK *LoaderBlock){
NTSTATUS v1;
unsigned int v3;
unsigned __int64 v4;
char v6;
_QWORD v7[3];
_RTL_QUERY_REGISTRY_TABLE result[2];
UINT8 IncludeType[30];
__int16 v10;
char v11;
char v12;
v1 = 0;
v6 = 0;
IopReportBugCheckProgress = (__int64)HalSetEnvironmentVariableEx;
if( !ForceDumpDisabled && (int)SecureDump_Init() < 0 )
ForceDumpDisabled = 1;
if( (*((_DWORD *)LoaderBlock + 66) & 2) != 0 )
IopReportBugCheckProgress = (__int64)VslReportBugCheckProgress;
v3 = 0;
v4 = 0i64;
do
{
if( v4 >= 0x29 )
_report_rangecheckfailure();
IncludeType[v4] = 0;
++v3;
++v4;
}
while( v3 < 0x29 );
v10 = 257;
IncludeType[6] = 1;
v11 = 1;
v12 = 1;
SpecialMemoryRanges = (__int64)MmInitializeMemoryLimits(LoaderBlock, IncludeType);
memset((INT64)result, 0i64);
result[0].Flags = 4;
result[0].QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))IopInitCrashDumpRegCallback;
result[0].DefaultType = 0;
result[0].Name = L"ExistingPageFiles";
result[0].EntryContext = &v6;
RtlQueryRegistryValuesEx(2ui64, L"Session Manager\\Memory Management", result, LoaderBlock, 0i64);
if( !v6 )
{
*(_OWORD *)&v7[1] = 0i64;
v1 = IoInitializeCrashDump(0i64, (UNICODE_STRING *)&v7[1]) == 0 ? 0xC0000001 : 0;
}
IopInitializeOfflineCrashDump(*((_LOADER_PARAMETER_EXTENSION **)LoaderBlock + 30));
return v1;
}Referenced by:
IoInitSystemPreDrivers