DbgkWerCaptureLiveKernelDump

NTSTATUS __stdcall DbgkWerCaptureLiveKernelDump(
        const WCHAR *ComponentName,
        UINT64 BugCheckCode,
        UINT64 P1,
        UINT64 P2,
        UINT64 P3,
        UINT64 P4,
        VOID *CallbackContext,
        INT64 *CallbackRoutine,
        VOID *a9,
        INT64 *a10,
        VOID *a11,
        const _GUID *a12,
        VOID *a13,
        UINT64 a14,
        UINT64 a15,
        UINT64 a16,
        UINT64 a17,
        UINT64 a18,
        UINT64 a19,
        VOID *a20,
        DBGK_LIVEDUMP_FLAGS Flags){
  int v23; 
  _ETHREAD *CurrentThread; 
  int v27; 
  VOID **PoolWithTag; 
  VOID **v29; 
  unsigned int v30; 
  _WER_LIVE_KERNEL_POLICY v31; 
  int v32; 
  char FreeContext[4]; 
  _WER_LIVE_KERNEL_POLICY WerPolicy; 
  VOID *hWerReport; 

  FreeContext[0] = 1;
  WerPolicy = WerLiveKernelPolicyNoDump;
  hWerReport = 0i64;
  v23 = BugCheckCode;
  if( KeGetCurrentIrql() )
  {
    DbgPrintEx(5u, 1u, "DBGK: DbgkWerCaptureLiveKernelDump: called at IRQL > PASSIVE_LEVEL\n");
    return -1073741496;
  }
  if( !byte_140C50880 )
  {
    DbgPrintEx(5u, 1u, "DBGK: DbgkWerCaptureLiveKernelDump: called before initialization.\n");
    return -1073741661;
  }
  if( DbgkpWerIsFullLiveDumpDisabled() )
  {
    DbgPrintEx(5u, 1u, "DBGK: Full Live Kernel Dumps are disabled. Failing request.\n");
    return -1073739772;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  if( _InterlockedExchange(&DbgkpBusy, 1) != 1 )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0xB8ui64, 1466393156i64);
    v29 = PoolWithTag;
    if( PoolWithTag )
    {
      memset(PoolWithTag, 0i64, 0xB8u);
      v27 = RtlStringCchLengthW((WCHAR *)ComponentName, 0x10ui64, 0i64);
      if( v27 >= 0 )
      {
        v27 = RtlStringCchCopyW((WCHAR *)v29, v30, (WCHAR *)ComponentName);
        if( v27 >= 0 )
        {
          v31 = DbgkpWerDefaultPolicy;
          if( ((unsigned __int8)a9 & 2) != 0 )
            v31 = WerLiveKernelPolicyMiniDump;
          WerPolicy = v31;
          v29[7] = (VOID *)P3;
          v29[8] = (VOID *)P4;
          v29[9] = CallbackContext;
          v29[10] = CallbackRoutine;
          *((_DWORD *)v29 + 8) = v23;
          v29[5] = (VOID *)P1;
          v29[6] = (VOID *)P2;
          *((_DWORD *)v29 + 22) = (_DWORD)a9;
          v32 = WerLiveKernelCreateReport(v29, &WerPolicy, &hWerReport);
          v27 = v32;
          if( v32 >= 0 )
          {
            v27 = DbgkpWerProcessPolicyResult((_DBGKWER_CONTEXT *)v29, WerPolicy, hWerReport, (UINT8 *)FreeContext);
            if( !FreeContext[0] )
              goto LABEL_20;
          }
          else
          {
            DbgPrintEx(
              5u,
              0,
              "DBGK: DbgkWerCaptureLiveKernelDump: WerLiveKernelCreateReport failed, status 0x%x.\n\n",
              (unsigned int)v32);
          }
        }
      }
      DbgkpWerCleanupContext((_DBGKWER_CONTEXT *)v29);
      ExFreePoolWithTag(v29, 0x57676244u);
    }
    else
    {
      v27 = -1073741670;
    }
    _InterlockedExchange(&DbgkpBusy, 0);
    goto LABEL_20;
  }
  v27 = -1073741267;
LABEL_20:
  KeLeaveCriticalRegion();
  return v27;
}

Referenced by: