KiDumpParameterImages

void __fastcall KiDumpParameterImages(NTSTRSAFE_PSTR pszDest, unsigned __int64 *a2, unsigned int a3, char a4){
  __int64 v7; 
  UNICODE_STRING *UnloadedDriver; 
  UINT16 *p_Length; 
  UINT16 *v10; 
  _LDR_DATA_TABLE_ENTRY *v11; 
  char InKernelOrHal[8]; 
  _LDR_DATA_TABLE_ENTRY *DataTableEntry; 
  BYTE v14[128]; 
  DataTableEntry = 0i64;
  InKernelOrHal[0] = 0;
  if( pszDest )
    *pszDest = 0;
  if( a3 )
  {
    v7 = a3;
    while( !KiPcToFileHeader((VOID *)*a2, &DataTableEntry, 1ui64, (UINT8 *)InKernelOrHal) )
    {
      UnloadedDriver = MmLocateUnloadedDriver((PVOID)*a2);
      p_Length = &UnloadedDriver->Length;
      if( UnloadedDriver )
      {
        if( a4 )
        {
          v10 = &UnloadedDriver->Length;
          goto LABEL_13;
        }
        goto LABEL_14;
      }
LABEL_17:
      ++a2;
      if( !--v7 )
        return;
    }
    v11 = DataTableEntry;
    if( MmIsAddressValidEx((INT64)DataTableEntry->DllBase) )
      RtlImageNtHeader(v11->DllBase);
    p_Length = &v11->BaseDllName.Length;
    if( a4 )
    {
      v10 = p_Length;
LABEL_13:
      KiBugCheckUnicodeToAnsi(v10, v14);
    }
LABEL_14:
    if( pszDest )
      RtlStringCbPrintfA(pszDest, 0x80ui64, (INT8 *)"%s**  %12s - Address %p base at %p, DateStamp %08lx\r\n");
    KiBugCheckDriver = p_Length;
    goto LABEL_17;
  }
}

Referenced by: