IopInitializeInMemoryDumpData

VOID __stdcall IopInitializeInMemoryDumpData(){
  __int64 v0; 
  char v1; 
  int v2; 
  PVOID *v3; 
  __int64 *v4; 
  unsigned int v5; 
  VOID *ContiguousNodeMemory; 
  __int64 v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  int v10; 
  UINT64 Attributes; 
  UINT64 PreferredNode; 
  __int128 v13; 
  GUID VendorGuid; 
  VendorGuid.Data1 = 2012912317;
  *(_DWORD *)&VendorGuid.Data2 = 1295123289;
  *(_DWORD *)VendorGuid.Data4 = -198680387;
  *(_DWORD *)&VendorGuid.Data4[4] = 1266192359;
  *(_QWORD *)&v13 = 0x302E4594353594B3i64;
  v0 = 2i64;
  *((_QWORD *)&v13 + 1) = 0xB50211F197DACBD4ui64;
  if( _InterlockedExchange(InMemData, 1) != 1 )
  {
    dword_140C50944 = 0;
    LODWORD(qword_140C50930) = 0;
    v1 = 0;
    ZwFilterBootOption();
    if( v2 >= 0 || v2 == -2143092730 && (_BYTE)KdDebuggerEnabled )
      v1 = 1;
    v3 = (PVOID *)qword_140C50918;
    qword_140C50928 = 9112i64;
    v4 = qword_140C50918;
    v5 = 0;
    while( 1 )
    {
      LODWORD(PreferredNode) = 0x80000000;
      LODWORD(Attributes) = 4;
      ContiguousNodeMemory = MmAllocateContiguousNodeMemory(
                               qword_140C50928,
                               0i64,
                               (LARGE_INTEGER)-1i64,
                               0i64,
                               Attributes,
                               PreferredNode);
      *v4 = (__int64)ContiguousNodeMemory;
      if( !ContiguousNodeMemory )
        break;
      memset((INT64)ContiguousNodeMemory, 0i64);
      v7 = *v4;
      *(_OWORD *)v7 = v13;
      *(_QWORD *)(v7 + 16) = 0x199B7088610836E8i64;
      if( v1 )
        KdCopyDataBlock((_OWORD *)(*v4 + 8216));
      ++v5;
      ++v4;
      if( v5 >= 2 )
      {
        v8 = __rdtsc();
        LODWORD(qword_140C50938) = v8;
        v9 = __rdtsc();
        HIDWORD(qword_140C50938) = v9;
        LODWORD(Attributes) = 7;
        HIDWORD(qword_140C50938) = ExGenRandom(1i64) & 0x7FFFFFFF;
        v10 = IoSetEnvironmentVariableEx((WCHAR *)L"DumpInstance", &VendorGuid, &qword_140C50938, 8ui64, Attributes);
        if( v10 < 0 )
        {
          dword_140C50944 = v10;
          qword_140C50938 = 0x4547415045474150i64;
        }
        dword_140C50914 = 1;
        goto LABEL_18;
      }
    }
    dword_140C50944 = -1073741801;
    do
    {
      if( *v3 )
      {
        MmFreeContiguousMemory(*v3);
        *v3 = 0i64;
      }
      ++v3;
      --v0;
    }
    while( v0 );
LABEL_18:
    _InterlockedExchange(InMemData, 0);
  }
}

Referenced by: