MmGetPageFileForCrashDump

VOID *__stdcall MmGetPageFileForCrashDump(){
  _ETHREAD *CurrentThread; 
  VOID *v1; 
  unsigned __int64 v2; 
  char *v3; 
  __int64 v4; 
  __int64 v5; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v1 = 0i64;
  v2 = 0i64;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&stru_140C50B28 + 117, 0i64);
  if( *(&stru_140C50B28 + 1708) )
  {
    v3 = (char *)&stru_140C50B28 + 6840;
    v4 = *(&stru_140C50B28 + 1708);
    do
    {
      v5 = *(_QWORD *)v3;
      if( (*(_WORD *)(*(_QWORD *)v3 + 204i64) & 0x850) == 0 && *(_QWORD *)(v5 + 16) > v2 )
      {
        v1 = *(VOID **)(v5 + 224);
        v2 = *(_QWORD *)(v5 + 16);
      }
      v3 += 8;
      --v4;
    }
    while( v4 );
  }
  if( (_InterlockedExchangeAdd64((_QWORD *)&stru_140C50B28 + 117, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)&stru_140C50B28 + 117);
  KeAbPostRelease((char *)&stru_140C50B28 + 936);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return v1;
}

Referenced by: