MmAddRangeToCrashDump
__int64 __fastcall MmAddRangeToCrashDump(
__int64 (__fastcall **a1)(_QWORD, __int64, __int64),
unsigned __int64 a2,
__int64 a3){
__int64 v6;
BOOL IsWorkingSetTrimThread;
int v8;
unsigned __int64 v9;
_MMPTE *PteBase;
char *v11;
__int64 v12;
INT64 result;
char v15;
unsigned __int64 v16;
unsigned __int64 v17;
int v18;
memset((INT64)&result, 0i64);
v6 = 1i64;
if( (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 )
{
IsWorkingSetTrimThread = MiIsWorkingSetTrimThread();
v8 = v18;
if( !IsWorkingSetTrimThread )
v8 = v6;
v18 = v8;
}
v16 = a2;
v9 = a3 + a2 - 1;
PteBase = MmGetPteBase();
v17 = v9;
v11 = &v15;
v12 = 4i64;
do
{
a2 = (unsigned __int64)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64);
v9 = (unsigned __int64)PteBase + ((v9 >> 9) & 0x7FFFFFFFF8i64);
*((_QWORD *)v11 - 1) = a2;
*(_QWORD *)v11 = v9;
v11 += 16;
v12 -= v6;
}
while( v12 );
return MiAddRangeToCrashDump(a1, a2, v9, (__int64)&result, 3u);
}Referenced by:
ExAddPrivateDataToCrashDump
IopAddLiveDumpPagesToPartialKernelDump
IopAddMiniDumpPagesToPartialKernelDump
IopAddTriageDumpDataToPartialKernelDump
IopLiveDumpAddTriageDumpData
IopLiveDumpMarkDeviceNode
IopLiveDumpMarkImportantDumpData
IopLiveDumpMarkLoadedModuleList
IopLiveDumpMarkProcessorData
IopLiveDumpMarkRequiredDumpData
IopMarkPagesForDeviceNode
IopMarkPagesForDpcData
IopMarkPagesForLoadedDriverInformation
IopMarkPagesForProcessorData
IopMarkPagesForRunTimeTriageDataBlocks
MiAddPartitionDataToCrashDump
MiAddUnicodeStringToCrashDump
MmAddPrivateDataToCrashDump
MmAddUnloadedDriverInformationToCrashDump
MmGetDumpRange