IopLiveDumpTraceMmDuplicateMemoryFailure
CHAR __fastcall IopLiveDumpTraceMmDuplicateMemoryFailure(INT64 a1, INT64 a2){
CHAR result;
__int64 v3;
GUID *ActivityId;
EVENT_DESCRIPTOR *v5;
UINT64 UserDataCount;
BOOL v7;
EVENT_DATA_DESCRIPTOR UserData;
BOOL *v9;
__int64 v10;
int v11;
v11 = a2;
v7 = a2 == 258;
result = IopLiveDumpIsTracingEnabled();
if( result )
{
*(_QWORD *)&UserData.Size = 4i64;
UserData.Ptr = (unsigned __int64)&v11;
v5 = (EVENT_DESCRIPTOR *)LIVEDUMP_EVENT_SIZING_WORKFLOW_MM_DUPLICATE_MEMORY_FAILURE;
v10 = 4i64;
v9 = &v7;
if( (*(_DWORD *)(v3 + 80) & 1) == 0 )
v5 = (EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MM_DUPLICATE_MEMORY_FAILURE;
LODWORD(UserDataCount) = 2;
return EtwWriteEx(
IopLiveDumpEtwRegHandle,
v5,
(UINT64)ActivityId,
0i64,
ActivityId,
ActivityId,
UserDataCount,
&UserData);
}
return result;
}Referenced by:
IopLiveDumpCaptureMemoryPages
IopLiveDumpEstimateMemoryPages