MmGetDumpRange

VOID __stdcall MmGetDumpRange(PVOID Context, _MM_DUMP_TYPE DumpType, UINT64 Flags){
  _MMPFN *PfnDb; 
  char v4; 
  _KPRCB **v6; 
  __int64 v7; 
  signed __int64 v8; 
  char *v9; 
  char *v10; 
  PHYSICAL_MEMORY_DESCRIPTOR *v11; 
  unsigned int i; 
  __int64 PageCount; 
  __int64 BasePage; 
  unsigned int v15; 
  unsigned int v16; 
  int v17; 
  int v18; 
  __int64 v19; 
  unsigned int v20; 
  unsigned int v21; 
  _QWORD *v22; 
  __int64 j; 
  unsigned __int64 v24; 
  unsigned int v25; 
  unsigned int v26; 
  __int64 v27; 
  __int64 v28; 
  _MMPFN *v29; 
  _MMPFN *v30; 
  unsigned __int64 v31; 
  _MMPFN *v32; 
  signed __int64 v33; 
  int v34; 

  PfnDb = MmGetPfnDb();
  v4 = Flags;
  if( DumpType )
  {
    v11 = MmPhysicalMemoryBlock;
    for( i = 0; i < MmPhysicalMemoryBlock->NumberOfRuns; ++i )
    {
      PageCount = v11->Run[i].PageCount;
      BasePage = v11->Run[i].BasePage;
      if( (MiFlags & 0x8000) != 0 )
        MiAddNonSecuredPagesToDump(
          (__int64(__fastcall **)(_QWORD, __int64, __int64, __int64))Context,
          BasePage,
          PageCount);
      else(*(void(__fastcall **)(PVOID, __int64, __int64, __int64))Context)(Context, BasePage, PageCount, 2i64);
      v11 = MmPhysicalMemoryBlock;
    }
  }
  else
  {
    if( (_DWORD)KeNumberProcessors_0 )
    {
      v6 = &KiProcessorBlock;
      v7 = (unsigned int)KeNumberProcessors_0;
      do
      {
        (*(void(__fastcall **)(PVOID, unsigned __int64, __int64, __int64))Context)(
          Context,
          (*v6++)->CurrentThread->Tcb.ApcState.Process->Pcb.DirectoryTableBase >> 12,
          1i64,
          2i64);
        --v7;
      }
      while( v7 );
      PfnDb = MmGetPfnDb();
    }
    MmAddRangeToCrashDump((_MM_KERNEL_DUMP_CONTEXT *)Context, (VOID *)0xFFFF800000000000i64, 0x800000000000ui64);
    if( (v4 & 1) != 0 && (KiBugCheckActive & 3) != 0 )
      MmAddRangeToCrashDump((_MM_KERNEL_DUMP_CONTEXT *)Context, 0i64, 0x7FFFFFFF0000ui64);
    v8 = __readcr3();
    (*(void(__fastcall **)(PVOID, signed __int64, __int64, __int64))Context)(Context, v8 / 4096, 1i64, 2i64);
    if( (v4 & 2) != 0 )
    {
      MiAddPhysicalPagesToCrashDump((_MM_KERNEL_DUMP_CONTEXT *)Context);
      MmRemoveSystemCacheFromDump((_MM_KERNEL_DUMP_CONTEXT *)Context);
    }
    v9 = (char *)qword_140C4C618;
    while( v9 )
    {
      v10 = v9;
      v9 = *(char **)v9;
      (*((void(__fastcall **)(PVOID, signed __int64, __int64, __int64))Context + 1))(
        Context,
        (v10 - (char *)PfnDb) / 48,
        1i64,
        2i64);
    }
  }
  v15 = 0;
  while( 1 )
  {
    v16 = v15 < **(&stru_140C4DB30 + 263) ? v15 : 0;
    v17 = **(&stru_140C4DB30 + 263) - 1;
    v18 = (*(_DWORD *)(*(&stru_140C4DB30 + 263) + 8i64) & 4) != 0i64 ? 0x20 : 0;
    v19 = *(_QWORD *)(*(&stru_140C4DB30 + 263) + 8i64)
        - ((*(_QWORD *)(*(&stru_140C4DB30 + 263) + 8i64) & 4i64) != 0 ? 4 : 0);
    while( 1 )
    {
      v20 = v18 + v17;
      if( v17 - v16 == -1 )
        goto LABEL_23;
      v22 = (_QWORD *)(v19 + 8 * ((unsigned __int64)(v18 + v16) >> 6));
      for( j = ~*v22 | ((1i64 << ((v18 + v16) & 0x3F)) - 1); j == -1; j = ~*v22 )
      {
        if( (unsigned __int64)++v22 > v19 + 8 * ((unsigned __int64)v20 >> 6) )
          goto LABEL_23;
      }
      _BitScanForward64(&v24, ~j);
      v21 = v24 + ((unsigned int)(((__int64)v22 - v19) >> 3) << 6);
      if( v21 > v20 )
      {
LABEL_23:
        v21 = -1;
      }
      else if( v21 != -1 )
      {
        break;
      }
      if( !v16 )
        break;
      v25 = v15 + 1;
      v16 = 0;
      if( v15 + 1 > **(&stru_140C4DB30 + 263) )
        v25 = **(&stru_140C4DB30 + 263);
      v17 = v25 - 1;
    }
    v26 = v21 - v18;
    if( v21 == -1 )
      v26 = -1;
    if( v26 < v15 || v26 == -1 )
      break;
    v15 = v26 + 1;
    v27 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * v26);
    if( (*(_DWORD *)(v27 + 4) & 2) != 0 )
    {
      v28 = *(_QWORD *)(v27 + 4112);
      if( v28 != 0xFFFFFFFFFi64 )
      {
        v29 = MmGetPfnDb();
        do
        {
          (*((void(__fastcall **)(PVOID, __int64, __int64, __int64))Context + 1))(Context, v28, 1i64, 2i64);
          v28 = v29[v28].u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 & 0xFFFFFFFFFi64;
        }
        while( v28 != 0xFFFFFFFFFi64 );
      }
    }
  }
  if( *(&stru_140C4DB30 + 2568) == 1 )
  {
    v30 = MmGetPfnDb();
    v31 = (unsigned __int64)v30;
    v32 = &v30[*(&stru_140C50B28 + 852)];
    if( v30 <= v32 )
    {
      do
      {
        v33 = v31 - (_QWORD)v30;
        if( (*((_BYTE *)&MmGetPfnDb()->u3 + v31 - (_QWORD)v30 + 3) & 0x40) != 0
          || (LOBYTE(v34) = MiIsPageOnBadList(v31), v34) )
        {
          (*((void(__fastcall **)(PVOID, signed __int64, __int64, __int64))Context + 1))(Context, v33 / 48, 1i64, 2i64);
        }
        v31 += 48i64;
        v30 = MmGetPfnDb();
      }
      while( v31 <= (unsigned __int64)v32 );
    }
  }
  if( *(&stru_140C4DB30 + 530) )
    MiRemoveEnclavePagesFromDump((__int64)Context);
}

Referenced by: