IopLiveDumpAllocateFromVMMemoryPartition

UINT64 __fastcall IopLiveDumpAllocateFromVMMemoryPartition(INT64 a1, UINT64 a2, MDL **a3){
  int v3; 
  PVOID MappedSystemVa; 
  MDL *PartitionNodePagesForMdl; 
  void **v7; 
  int v8; 
  NTSTATUS v9; 
  void *v10; 
  unsigned int v11; 
  int v12; 
  int v13; 
  UINT64 Priority; 
  UINT64 Prioritya; 
  UINT64 Flags; 
  UINT64 Flagsa; 
  bool v19; 
  PVOID Object; 
  UINT64 TotalBytes; 
  MDL **v22; 
  struct _UNICODE_STRING DestinationString; 
  __int128 v24; 
  __int128 v25; 
  __int128 v26; 
  struct _EVENT_DATA_DESCRIPTOR v27[2]; 
  bool *v28; 
  int v29; 
  int v30; 
  PVOID *p_Object; 
  int v32; 
  int v33; 
  v3 = *(_DWORD *)(a1 + 80);
  MappedSystemVa = 0i64;
  v22 = a3;
  PartitionNodePagesForMdl = 0i64;
  TotalBytes = a2;
  v24 = 0i64;
  v25 = 0i64;
  v26 = 0i64;
  DestinationString = 0i64;
  if( (v3 & 0xC) != 0 )
    return 0i64;
  v7 = (void **)(a1 + 992);
  if( *(_QWORD *)(a1 + 992) )
    goto LABEL_5;
  RtlInitUnicodeString(&DestinationString, L"\\KernelObjects\\MemoryPartitionHyperV", (WCHAR)a3);
  *((_QWORD *)&v24 + 1) = 0i64;
  *(_QWORD *)&v25 = &DestinationString;
  LODWORD(v24) = 48;
  DWORD2(v25) = 512;
  v26 = 0i64;
  ZwOpenPartition();
  v9 = v8;
  if( v8 < 0 )
    goto LABEL_14;
  v10 = *v7;
  Object = 0i64;
  v9 = ObReferenceObjectByHandle(v10, 2u, PsPartitionType, 0, &Object, 0i64);
  *(_QWORD *)(a1 + 1000) = Object;
  if( v9 >= 0 )
  {
LABEL_5:
    v11 = BufferChunkSizeInBytes;
    LODWORD(Flags) = 101;
    LODWORD(Priority) = 0;
    PartitionNodePagesForMdl = MmAllocatePartitionNodePagesForMdlEx(
                                 0i64,
                                 (LARGE_INTEGER)-1i64,
                                 (LARGE_INTEGER)(unsigned int)BufferChunkSizeInBytes,
                                 TotalBytes,
                                 MmCached,
                                 Priority,
                                 Flags,
                                 *(PVOID *)(a1 + 1000));
    if( PartitionNodePagesForMdl
      || (LODWORD(Flagsa) = 37,
          LODWORD(Prioritya) = 0,
          (PartitionNodePagesForMdl = MmAllocatePartitionNodePagesForMdlEx(
                                        0i64,
                                        (LARGE_INTEGER)-1i64,
                                        (LARGE_INTEGER)v11,
                                        TotalBytes,
                                        MmCached,
                                        Prioritya,
                                        Flagsa,
                                        *(PVOID *)(a1 + 1000))) != 0i64) )
    {
      if( (PartitionNodePagesForMdl->MdlFlags & 5) != 0 )
        MappedSystemVa = PartitionNodePagesForMdl->MappedSystemVa;
      else
        MappedSystemVa = MmMapLockedPagesSpecifyCache(PartitionNodePagesForMdl, 0, MmCached, 0i64, 0, 0x40000020u);
    }
    else
    {
      *(_DWORD *)(a1 + 80) |= 8u;
      IopLiveDumpTraceAllocationFromVMMemoryPartitionFailure();
      if( (unsigned int)dword_140C04498 > 5 )
      {
        if( tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
        {
          v12 = *(_DWORD *)(a1 + 80);
          v30 = 0;
          v33 = 0;
          v29 = 1;
          v19 = (v12 & 8) != 0;
          v28 = &v19;
          p_Object = &Object;
          LODWORD(Object) = -1073741801;
          v32 = 4;
          tlgWriteTransfer_EtwWriteTransfer(
            (__int64)&dword_140C04498,
            (unsigned __int8 *)byte_140023703,
            (const GUID *)(a1 + 864),
            (const GUID *)(a1 + 848),
            4u,
            v27);
        }
      }
    }
  }
  else
  {
LABEL_14:
    *(_DWORD *)(a1 + 80) |= 4u;
    IopLiveDumpTraceOpenVMMemoryPartitionFailure(a1, (unsigned int)v9);
    if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
    {
      v13 = *(_DWORD *)(a1 + 80);
      v30 = 0;
      v33 = 0;
      v29 = 1;
      v19 = (v13 & 4) != 0;
      v28 = &v19;
      p_Object = &Object;
      LODWORD(Object) = v9;
      v32 = 4;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&dword_140C04498,
        (unsigned __int8 *)byte_1400236B5,
        (const GUID *)(a1 + 864),
        (const GUID *)(a1 + 848),
        4u,
        v27);
    }
  }
  if( PartitionNodePagesForMdl )
  {
    if( !MappedSystemVa )
    {
      MmFreePagesFromMdl(PartitionNodePagesForMdl);
      ExFreePoolWithTag(PartitionNodePagesForMdl, 0);
      return 0i64;
    }
    *v22 = PartitionNodePagesForMdl;
  }
  return(UINT64)MappedSystemVa;
}

Referenced by: