DbgkCaptureLiveDump

NTSTATUS __stdcall DbgkCaptureLiveDump(
        _SYSDBG_TRIAGE_DUMP *TriageDumpRequest,
        VOID *DumpBuffer,
        UINT64 DumpBufferLength,
        VOID *BufferUsed){
  unsigned int v4; 
  unsigned __int64 v7; 
  _ETHREAD *v8; 
  PEPROCESS v9; 
  VOID **PoolWithTag; 
  UINT64 v11; 
  int v12; 
  __int64 v13; 
  NTSTATUS v14; 
  unsigned int i; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  VOID *v19; 
  NTSTATUS v20; 
  UINT64 v21; 
  int v22; 
  char v23; 
  PEPROCESS v24; 
  int v25; 
  UINT64 v26; 
  char AccessMode; 
  char v29; 
  unsigned __int64 RegHandle; 
  PVOID Object; 
  VOID *InDumpCopy; 
  __int128 Buffer; 
  VOID *v34; 
  _DUMP_FILE_DESCRIPTOR DumpFile[2584]; 
  INT64 a2[2]; 

  v4 = DumpBufferLength;
  v34 = BufferUsed;
  v7 = 0i64;
  AccessMode = KeGetCurrentThread()->PreviousMode;
  v8 = 0i64;
  v9 = 0i64;
  memset(DumpFile, 0i64, sizeof(DumpFile));
  PoolWithTag = 0i64;
  InDumpCopy = 0i64;
  *(_OWORD *)a2 = 0i64;
  RegHandle = 0i64;
  Buffer = 0i64;
  if( !TriageDumpRequest[11] || v4 < 0x40000 || (*TriageDumpRequest & 0xFFFFFFFE) != 0 )
    return -1073741811;
  if( DbgkpLkmdSqmIsOptedIn() )
  {
    EtwRegister((_LPCGUID)&CmFcpWnfTypeId.TypeId[1], 0i64, 0i64, &RegHandle);
    v7 = RegHandle;
    if( RegHandle )
      DbgkpLkmdSqmIncrementDword(RegHandle, 0xCDCui64, v11);
  }
  memset(&DumpFile[2560], 0, 48);
  v12 = DbgkpTriageDumpInitialize(
          (__int64)&DumpFile[2560],
          (__int64)DumpBuffer,
          v4,
          (INT64(__stdcall **)(VOID *, UINT64, UINT64, UINT64, UINT64, UINT64))&DumpFile[2572]);
  v13 = 0i64;
  v14 = v12;
  if( v12 >= 0 )
  {
    v14 = (*(__int64(__fastcall **)(_DUMP_FILE_DESCRIPTOR *, _QWORD, _QWORD, _QWORD, _QWORD, _QWORD))&DumpFile[2572])(
            &DumpFile[2560],
            (unsigned int)TriageDumpRequest[1],
            *((_QWORD *)TriageDumpRequest + 1),
            *((_QWORD *)TriageDumpRequest + 2),
            *((_QWORD *)TriageDumpRequest + 3),
            *((_QWORD *)TriageDumpRequest + 4));
    if( v14 >= 0 )
    {
      DbgkpLkmdSnapGlobals(DumpFile);
      LODWORD(RegHandle) = 4 * TriageDumpRequest[11] + 4;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)RegHandle, 1884181323i64);
      if( PoolWithTag )
      {
        for( i = 0; i < TriageDumpRequest[11]; *((_DWORD *)PoolWithTag + v16) = -1073741823 )
          v16 = i++;
        *((_DWORD *)PoolWithTag + i) = 1112752980;
      }
      v14 = -1073741790;
      v29 = 1;
      if( TriageDumpRequest[11] )
      {
        while( 1 )
        {
          v17 = *((_QWORD *)TriageDumpRequest + 6);
          v18 = (unsigned int)(v13 + TriageDumpRequest[10]);
          a2[1] = 0i64;
          a2[0] = 3221225473i64;
          v19 = *(VOID **)(v17 + 8 * v18);
          Object = 0i64;
          v20 = ObReferenceObjectByHandle(v19, 0x1FFFFFui64, (_OBJECT_TYPE *)PsThreadType, AccessMode, &Object, 0i64);
          v8 = (_ETHREAD *)Object;
          v22 = v20;
          v23 = v29;
          if( v22 != -1073741790 )
            v23 = 0;
          v29 = v23;
          if( v22 >= 0 )
          {
            if( !v9 )
            {
              v24 = IoThreadToProcess((PETHREAD)Object);
              v9 = v24;
              if( v24 )
              {
                ObfReferenceObjectWithTag(v24, 0x4C676244ui64);
                DbgkpLkmdSnapDataEx(DumpFile, v9, 0xA40ui64, ClassProcess, 0i64, 0i64);
              }
            }
            v25 = DbgkpLkmdSnapThread((__int64)DumpFile, (__int64)TriageDumpRequest, v8, (__int64)a2);
            if( !v25 )
              v25 = a2[0];
            if( PoolWithTag )
              *((_DWORD *)PoolWithTag + v13) = v25;
            DbgkpLkmdFireCallbacks(DumpFile, 2ui64, v8);
            if( v7 )
              DbgkpLkmdSqmStatus(v7, a2, v26);
            HalPutDmaAdapter((PADAPTER_OBJECT)v8);
            v8 = 0i64;
            if( LODWORD(a2[0]) == -1073741670 )
            {
LABEL_32:
              if( !v29 )
              {
                if( v9 )
                  DbgkpLkmdFireCallbacks(DumpFile, 1ui64, v9);
                LODWORD(Buffer) = TriageDumpRequest[11];
                *((_QWORD *)&Buffer + 1) = PoolWithTag;
                DbgkpLkmdSnapData(DumpFile, &Buffer, 0x10ui64);
                if( PoolWithTag )
                  DbgkpLkmdSnapData(DumpFile, PoolWithTag, (unsigned int)RegHandle);
                if( DbgkpLkmdSnapDataEx(
                       DumpFile,
                       &DbgkpLkmdLiveDumpDiagnosticInformation,
                       8ui64,
                       ClassUnknown,
                       0i64,
                       &InDumpCopy) >= 0 )
                  *(_QWORD *)InDumpCopy = &Buffer;
                v14 = (*(__int64(__fastcall **)(_DUMP_FILE_DESCRIPTOR *, VOID *))&DumpFile[2582])(&DumpFile[2560], v34);
              }
              break;
            }
          }
          else
          {
            if( PoolWithTag )
              *((_DWORD *)PoolWithTag + v13) = v22;
            if( v7 )
            {
              LODWORD(a2[0]) = v22;
              DbgkpLkmdSqmStatus(v7, a2, v21);
            }
          }
          v13 = (unsigned int)(v13 + 1);
          if( (unsigned int)v13 >= TriageDumpRequest[11] )
            goto LABEL_32;
        }
      }
      if( v9 )
        ObfDereferenceObjectWithTag(v9, 0x4C676244ui64);
      if( v8 )
        HalPutDmaAdapter((PADAPTER_OBJECT)v8);
    }
  }
  if( *(_QWORD *)&DumpFile[2568] )
    ExFreePoolWithTag(*(PVOID *)&DumpFile[2568], 0x4D574454u);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x704E534Bu);
  if( v7 )
    EtwUnregister(v7);
  return v14;
}

Referenced by: