DbgkpTriageDumpInitialize
__int64 __fastcall DbgkpTriageDumpInitialize(
__int64 a1,
__int64 a2,
int a3,
INT64 (__stdcall **a4)(VOID *DumpObject, UINT64 BugCheckCode, UINT64 BugCheckParam1, UINT64 BugCheckParam2, UINT64 BugCheckParam3, UINT64 BugCheckParam4)){
VOID **PoolWithTag;
*(_DWORD *)(a1 + 12) = 0;
*(_DWORD *)(a1 + 16) = 0;
*(_DWORD *)(a1 + 20) = 0;
*(_DWORD *)(a1 + 24) = 0;
*(_QWORD *)a1 = a2;
*(_DWORD *)(a1 + 8) = a3;
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x6F98ui64, 1297564756i64);
*(_QWORD *)(a1 + 32) = PoolWithTag;
if( PoolWithTag )
{
memset(PoolWithTag, 0i64, 0x6F98u);
*(_DWORD *)(a1 + 40) = 0;
}
*a4 = (INT64(__stdcall *)(VOID *, UINT64, UINT64, UINT64, UINT64, UINT64))DbgkpTriageDumpFillHeaders;
a4[2] = (INT64(__stdcall *)(VOID *, UINT64, UINT64, UINT64, UINT64, UINT64))DbgkpTriageDumpSnapData;
a4[1] = (INT64(__stdcall *)(VOID *, UINT64, UINT64, UINT64, UINT64, UINT64))DbgkpTriageDumpIsMemoryBlockPresent;
a4[3] = (INT64(__stdcall *)(VOID *, UINT64, UINT64, UINT64, UINT64, UINT64))DbgkpTriageDumpSaveState;
a4[4] = (INT64(__stdcall *)(VOID *, UINT64, UINT64, UINT64, UINT64, UINT64))DbgkpTriageDumpRestoreState;
a4[5] = (INT64(__stdcall *)(VOID *, UINT64, UINT64, UINT64, UINT64, UINT64))DbgkpTriageDumpWrite;
return 0i64;
}Referenced by:
DbgkCaptureLiveDump