IopCalculateStackInformation
CHAR __fastcall IopCalculateStackInformation(INT64 a1, INT64 a2, UINT64 *a3, UINT64 *a4){
CHAR v4;
UINT64 v7;
UINT64 v8;
UINT64 v9;
INT64 v10;
UINT64 v11;
unsigned int v12;
void *v13;
int MaxValidMemorySize;
v4 = 0;
if( a1 && (*(_DWORD *)(a1 + 120) & 0x20000) != 0 )
{
v7 = *(_QWORD *)(a2 + 152);
v8 = *(_QWORD *)(a1 + 48);
v9 = *(_QWORD *)(a1 + 56);
if( v8 > v7 || v7 >= v9 )
{
*a3 = *(_QWORD *)(a1 + 48);
if( (*((_BYTE *)KeGetPcr() + 12972) & 1) != 0 && a1 != *((_QWORD *)KeGetCurrentPrcb() + 3) )
{
v10 = *((_QWORD *)KeGetPcr() + 1618);
if( KiIsAddressRangeValid(v10, 80i64) )
{
v11 = *(_QWORD *)(v10 + 64);
if( v8 <= v11 && v11 < v9 )
*a3 = v11;
}
}
}
else
{
*a3 = v7;
}
v12 = v9 - *(_DWORD *)a3;
v13 = (void *)*a3;
*(_DWORD *)a4 = v12;
MaxValidMemorySize = IopGetMaxValidMemorySize(v13, v12);
*(_DWORD *)a4 = MaxValidMemorySize;
if( *a3 && MaxValidMemorySize )
return 1;
}
return v4;
}Referenced by:
IopAddMiniDumpPagesToPartialKernelDump