DbgkpWerCaptureLiveFullDump

NTSTATUS __stdcall DbgkpWerCaptureLiveFullDump(_DBGKWER_CONTEXT *Context, UINT8 *FreeContext){
  VOID **PoolWithTag; 
  VOID **v5; 
  int v6; 
  _DBGKWER_CONTEXT v7; 
  int v8; 
  __int64 v9; 
  int v10; 
  unsigned int v11; 
  _WORK_QUEUE_ITEM *v12; 
  VOID *v14; 
  __int64 v15; 

  v15 = 0i64;
  *FreeContext = 1;
  Context[23] = 0x10000000;
  DbgPrintEx(5u, 3u, "DBGK: Creating full dump.  ComponentName %ws, Defer = %d\n", Context, 1);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x30ui64, 1466393156i64);
  v5 = PoolWithTag;
  if( PoolWithTag )
  {
    *(_OWORD *)PoolWithTag = 0i64;
    *((_OWORD *)PoolWithTag + 1) = 0i64;
    *((_OWORD *)PoolWithTag + 2) = 0i64;
    *((_QWORD *)Context + 16) = PoolWithTag;
    *(_DWORD *)PoolWithTag = 1;
    *((_DWORD *)PoolWithTag + 1) = 48;
    v7 = Context[22];
    if( (v7 & 1) != 0 )
    {
      *((_DWORD *)PoolWithTag + 6) |= 4u;
      v7 = Context[22];
    }
    v8 = *((_DWORD *)PoolWithTag + 6);
    if( (v7 & 4) != 0 )
      *((_DWORD *)v5 + 7) |= 1u;
    *((_DWORD *)v5 + 6) = v8 | 0x10;
    v9 = *((_QWORD *)Context + 13);
    v14 = 0i64;
    v10 = WerLiveKernelOpenDumpFile(v9, &v14);
    v6 = v10;
    if( v10 >= 0 )
    {
      v5[1] = v14;
      Context[28] |= 2u;
      *((_DWORD *)v5 + 6) |= 8u;
      v6 = DbgkpWerInitializeDeferredLiveDump(Context);
      if( v6 >= 0 )
      {
        v6 = DbgkpWerInvokeCallbacks(Context);
        if( v6 >= 0 )
        {
          IoCaptureLiveDump(
            (unsigned int)Context[8],
            *((_QWORD *)Context + 5),
            *((_QWORD *)Context + 6),
            *((_QWORD *)Context + 7));
          v6 = v11;
          if( (int)(v11 + 0x80000000) < 0 || v11 == -1073741802 )
          {
            v12 = (_WORK_QUEUE_ITEM *)*((_QWORD *)Context + 15);
            *((_QWORD *)Context + 17) = v15;
            ExQueueWorkItem(v12, DelayedWorkQueue);
            v6 = 0;
            *FreeContext = 0;
          }
          else
          {
            DbgPrintEx(5u, 0, "DBGK: DbgkpWerCaptureLiveFullDump: IoCaptureLiveDump failed with status 0x%X\n", v11);
          }
        }
      }
    }
    else
    {
      DbgPrintEx(5u, 0, "DBGK: WerLiveKernelOpenDumpFile failed. Status = 0x%X\n", (unsigned int)v10);
    }
  }
  else
  {
    DbgPrintEx(5u, 0, "DBGK: Could not allocate an Io Control.\n");
    return -1073741801;
  }
  return v6;
}

Referenced by: