IoFillDumpHeader

NTSTATUS __stdcall IoFillDumpHeader(UINT32 RelativeTo, PWSTR Path){
  int v2; 
  __int64 v3; 
  int v4; 
  __int64 v5; 
  void *v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  UINT64 v9; 
  PPHYSICAL_MEMORY_RANGE PhysicalMemoryRanges; 
  PPHYSICAL_MEMORY_RANGE v11; 
  __int64 v12; 
  LARGE_INTEGER *p_NumberOfBytes; 
  LARGE_INTEGER NumberOfBytes; 
  __int64 v15; 
  __int64 v16; 
  unsigned __int64 QuadPart; 
  NTSTATUS result; 
  __int64 v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  v4 = (int)Path;
  v5 = *(_QWORD *)&RelativeTo;
  v6 = *(void **)&RelativeTo;
  v7 = 2048i64;
  if( (RelativeTo & 4) != 0 )
  {
    **(_DWORD **)&RelativeTo = 1162297680;
    v6 = (void *)(*(_QWORD *)&RelativeTo + 4i64);
    v7 = 2047i64;
  }
  memset64(v6, 0x4547415045474150ui64, v7 >> 1);
  if( (v7 & 1) != 0 )
    *((_DWORD *)v6 + v7 - 1) = 1162297680;
  *(_QWORD *)(*(_QWORD *)&RelativeTo + 72i64) = v19;
  *(_QWORD *)(*(_QWORD *)&RelativeTo + 80i64) = v20;
  *(_QWORD *)(*(_QWORD *)&RelativeTo + 88i64) = v21;
  *(_DWORD *)(*(_QWORD *)&RelativeTo + 4i64) = 875976004;
  *(_DWORD *)(*(_QWORD *)&RelativeTo + 56i64) = v2;
  *(_QWORD *)(*(_QWORD *)&RelativeTo + 64i64) = v3;
  if( v22 )
    v8 = *(_QWORD *)(*(_QWORD *)(v22 + 184) + 40i64);
  else
    v8 = __readcr3();
  *(_QWORD *)(v5 + 16) = v8 & 0xFFFFFFFFFFFFF000ui64;
  *(_DWORD *)(v5 + 48) = 34404;
  *(_DWORD *)(v5 + 3992) = (_DWORD)Path;
  *(_QWORD *)(v5 + 24) = MmPfnDatabase;
  *(_QWORD *)(v5 + 32) = &PsLoadedModuleList;
  *(_QWORD *)(v5 + 40) = &PsActiveProcessHead;
  *(_QWORD *)(v5 + 128) = &KdDebuggerDataBlock;
  *(_DWORD *)(v5 + 52) = KeQueryActiveProcessorCountEx(0xFFFFu);
  *(_DWORD *)(v5 + 8) = (unsigned int)NtBuildNumber >> 28;
  *(_DWORD *)(v5 + 12) = (unsigned __int16)NtBuildNumber;
  if( (unsigned int)(v4 - 5) <= 1 || !MmPhysicalMemoryBlock )
    goto LABEL_24;
  if( KeGetCurrentIrql() > 1u )
  {
    v9 = 16 * ((unsigned int)(*(_DWORD *)MmPhysicalMemoryBlock - 1) + 2i64);
    if( v9 > 0x2BC )
      v9 = 700i64;
    memmove((UINT8 *)(v5 + 136), MmPhysicalMemoryBlock, v9);
    goto LABEL_25;
  }
  PhysicalMemoryRanges = MmGetPhysicalMemoryRanges();
  v11 = PhysicalMemoryRanges;
  if( !PhysicalMemoryRanges )
  {
LABEL_24:
    memset(v5 + 136, 0i64);
    goto LABEL_25;
  }
  v12 = 0i64;
  p_NumberOfBytes = &PhysicalMemoryRanges->NumberOfBytes;
  NumberOfBytes = PhysicalMemoryRanges->NumberOfBytes;
  v15 = 0i64;
  while( NumberOfBytes.QuadPart )
  {
    v12 = (unsigned int)(v12 + 1);
    v15 += (unsigned __int64)NumberOfBytes.QuadPart >> 12;
    NumberOfBytes = PhysicalMemoryRanges[(unsigned int)v12].NumberOfBytes;
  }
  *(_QWORD *)(v5 + 144) = v15;
  if( 16 * ((unsigned __int64)(unsigned int)(v12 - 1) + 2) > 0x2BC )
    v12 = 42i64;
  *(_DWORD *)(v5 + 136) = v12;
  if( (_DWORD)v12 )
  {
    v16 = v5 - (_QWORD)PhysicalMemoryRanges;
    do
    {
      *(LONGLONG *)((char *)&p_NumberOfBytes[18].QuadPart + v16) = (unsigned __int64)p_NumberOfBytes[-1].QuadPart >> 12;
      QuadPart = p_NumberOfBytes->QuadPart;
      p_NumberOfBytes += 2;
      *(LONGLONG *)((char *)&p_NumberOfBytes[17].QuadPart + v16) = QuadPart >> 12;
      --v12;
    }
    while( v12 );
  }
  ExFreePoolWithTag(v11, 0);
LABEL_25:
  memset(v5 + 840, 0i64);
  *(_QWORD *)(v5 + 3848) = 0i64;
  *(_DWORD *)(v5 + 3864) = 0;
  *(_QWORD *)(v5 + 3856) = 0i64;
  *(_DWORD *)(v5 + 3840) = -2147483645;
  *(_DWORD *)(v5 + 3844) = 1;
  *(_DWORD *)(v5 + 4008) = KUSER_SHARED_DATA.SystemTime.LowPart;
  *(_DWORD *)(v5 + 4012) = KUSER_SHARED_DATA.SystemTime.High1Time;
  *(_DWORD *)(v5 + 4144) = KUSER_SHARED_DATA.InterruptTime.LowPart;
  *(_DWORD *)(v5 + 4148) = KUSER_SHARED_DATA.InterruptTime.High1Time;
  RtlGetNtProductType((_NT_PRODUCT_TYPE *)(v5 + 4160));
  *(_DWORD *)(v5 + 4164) = KUSER_SHARED_DATA.SuiteMask;
  result = KUSER_SHARED_DATA.BootId;
  *(_DWORD *)(v5 + 4176) = 0;
  *(_DWORD *)(v5 + 4180) = result;
  return result;
}

Referenced by: