IopLiveDumpWriteDumpFile

NTSTATUS __stdcall IopLiveDumpWriteDumpFile(_LIVEDUMP_CONTEXT *Context){
  INT64 v1; 
  _LIVEDUMP_CONTEXT *v2; 
  VOID *v3; 
  VOID **v5; 
  _LARGE_INTEGER v6; 
  unsigned __int64 v7; 
  _ETHREAD *CurrentThread; 
  int SecureDumpHeader; 
  _CONTEXT *v10; 
  _MDL *v11; 
  UINT64 v12; 
  _LIVEDUMP_CONTEXT v13; 
  UINT64 v14; 
  __int128 v15; 
  _LIVEDUMP_CONTEXT v16; 
  __int128 v17; 
  __int64 v18; 
  _LARGE_INTEGER v19; 
  UINT64 v20; 
  VOID **PoolWithTag; 
  _CONTEXT *v22; 
  _LARGE_INTEGER ByteOffset; 
  _ETHREAD *v25; 
  UINT64 BytesWritten; 
  __int128 v27; 
  __int128 v28; 
  __int64 v29; 
  __int128 v30; 
  __int128 v31; 
  __int64 v32; 

  v1 = *((_QWORD *)Context + 70);
  v2 = Context + 170;
  v3 = (VOID *)*((_QWORD *)Context + 8);
  BytesWritten = 0i64;
  v5 = 0i64;
  v27 = 0i64;
  v29 = 0i64;
  v28 = 0i64;
  v32 = 0i64;
  v30 = 0i64;
  v31 = 0i64;
  if( *((_BYTE *)Context + 880) )
    v6.QuadPart = *(_QWORD *)(v1 + 8224) + (unsigned int)Context[222];
  else
    v6 = *(_LARGE_INTEGER *)(v1 + 8224);
  ByteOffset = v6;
  v7 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v25 = CurrentThread;
  if( !*((_QWORD *)Context + 92) )
  {
LABEL_14:
    v12 = RtlNumberOfSetBitsEx((_RTL_BITMAP_EX *)Context + 34);
    v13 = Context[246];
    v14 = v12;
    if( v13 )
    {
      v15 = *((_OWORD *)Context + 60);
      *(_QWORD *)&v28 = *((_QWORD *)Context + 122);
      v29 = *((_QWORD *)Context + 7);
      *((_QWORD *)Context + 7) = &v27;
      v27 = v15;
      DWORD2(v28) = v13;
    }
    v16 = Context[234];
    if( v16 )
    {
      v17 = *((_OWORD *)Context + 57);
      *(_QWORD *)&v31 = *((_QWORD *)Context + 116);
      v32 = *((_QWORD *)Context + 7);
      *((_QWORD *)Context + 7) = &v30;
      v30 = v17;
      DWORD2(v31) = v16;
    }
    SecureDumpHeader = IopLiveDumpWriteSecondaryData(v3, Context + 12, &ByteOffset, &BytesWritten);
    if( SecureDumpHeader < 0 )
      goto LABEL_29;
    v18 = (unsigned int)Context[222];
    v19 = ByteOffset;
    *(_DWORD *)(v1 + 4176) |= 0x10u;
    *(_QWORD *)(v1 + 4000) = v19.QuadPart - v18;
    *(_QWORD *)(v1 + 8232) = v14;
    *(_DWORD *)(v1 + 0x2000) = 1347241043;
    *(_DWORD *)(v1 + 8196) = 1347245380;
    if( *((_BYTE *)Context + 880) )
    {
      v20 = (unsigned int)Context[222];
      ByteOffset.QuadPart = v20;
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v20, 1886217292i64);
      v5 = PoolWithTag;
      if( !PoolWithTag )
      {
        SecureDumpHeader = -1073741670;
        goto LABEL_29;
      }
      SecureDumpHeader = SecureDump_Get_SecureDumpHeader(v1, (INT64)PoolWithTag, (unsigned int)Context[222]);
      if( SecureDumpHeader < 0 )
        goto LABEL_27;
    }
    else
    {
      ByteOffset.QuadPart = 0i64;
    }
    SecureDumpHeader = IopLiveDumpWriteBuffer(v3, (VOID *)v1, (_CONTEXT *)*(unsigned int *)(v1 + 8224), &ByteOffset);
    if( *((_BYTE *)Context + 880) )
    {
      v22 = (_CONTEXT *)(unsigned int)Context[222];
      ByteOffset.QuadPart = 0i64;
      SecureDumpHeader = IopLiveDumpWriteBuffer(v3, v5, v22, &ByteOffset);
    }
LABEL_27:
    if( v5 )
      ExFreePoolWithTag(v5, 0);
    goto LABEL_29;
  }
  while( 1 )
  {
    SecureDumpHeader = IopLiveDumpCheckTermination((INT64)Context, (INT64)CurrentThread);
    if( SecureDumpHeader < 0 )
      break;
    v10 = v7 >= *((_QWORD *)v2 + 7) - 1i64 ? (_CONTEXT *)(unsigned int)(v2[10] << 12) : (_CONTEXT *)(unsigned int)BufferChunkSizeInBytes;
    SecureDumpHeader = IopLiveDumpWriteBuffer(v3, *(VOID **)(*((_QWORD *)v2 + 9) + 8 * v7), v10, &ByteOffset);
    if( SecureDumpHeader < 0 )
      break;
    v11 = *(_MDL **)(*((_QWORD *)v2 + 10) + 8 * v7);
    if( v11 )
    {
      MmFreePagesFromMdl(v11);
      ExFreePoolWithTag(*(PVOID *)(*((_QWORD *)v2 + 10) + 8 * v7), 0);
      *(_QWORD *)(*((_QWORD *)v2 + 10) + 8 * v7) = 0i64;
    }
    else
    {
      MmFreeIndependentPages(*(VOID **)(*((_QWORD *)v2 + 9) + 8 * v7), (unsigned int)BufferChunkSizeInBytes);
    }
    *(_QWORD *)(*((_QWORD *)v2 + 9) + 8 * v7++) = 0i64;
    CurrentThread = v25;
    if( v7 >= *((_QWORD *)v2 + 7) )
      goto LABEL_14;
  }
LABEL_29:
  IopLiveDumpFreeDumpBuffers(v2);
  return SecureDumpHeader;
}

Referenced by: