PspRecordCrashedProcessIntoBlackbox

VOID __fastcall PspRecordCrashedProcessIntoBlackbox(INT64 a1){
  unsigned __int16 *v1; 
  int v2; 
  int v3; 
  VOID *PoolWithTag; 
  __int64 v5; 
  __int64 InputBuffer[3]; 
  int v7; 
  int v8; 
  v1 = *(unsigned __int16 **)(a1 + 1472);
  InputBuffer[2] = 0i64;
  v2 = 0;
  v8 = 0;
  if( v1 )
  {
    if( *((_QWORD *)v1 + 1) )
    {
      v3 = *v1;
      if( (_WORD)v3 )
        v2 = v3 + 2;
    }
  }
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)(v2 + 8), 0x62427350ui64);
  v5 = (__int64)PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    *(_DWORD *)v5 = 1;
    *(_DWORD *)(v5 + 4) = v2 + 8;
    if( v2 )
      memmove((UINT8 *)(v5 + 8), *((UINT8 **)v1 + 1), *v1);
    v7 = 13;
    InputBuffer[0] = v5;
    InputBuffer[1] = (unsigned int)(v2 + 8);
    ZwPowerInformation(TraceApplicationPowerMessage|0x40, InputBuffer, 0x20u, 0i64, 0);
    ExFreePoolWithTag((PVOID)v5, 0x62427350u);
  }
}

Referenced by: