IoWriteDeferredLiveDumpData

NTSTATUS __stdcall IoWriteDeferredLiveDumpData(VOID *LiveDumpContext){
  __int64 v2; 
  int v3; 
  UINT64 v4; 
  __int64 v5; 
  __int64 v6; 
  INT64 v7; 
  UINT64 v8; 
  __int64 v10; 
  unsigned __int64 v11; 
  _EVENT_DATA_DESCRIPTOR v12; 
  __int64 *v13; 
  int v14; 
  int v15; 
  unsigned __int64 *v16; 
  int v17; 
  int v18; 

  v2 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
  IopLiveDumpTraceInterfaceStart(1ui64);
  IopLiveDumpTrace();
  v3 = IopLiveDumpWriteDumpFile((_LIVEDUMP_CONTEXT *)LiveDumpContext);
  IopLiveDumpTraceDumpFileWriteEnd((_LIVEDUMP_CONTEXT *)LiveDumpContext, 1ui64, (unsigned int)v3);
  if( v3 >= 0 && (*((_BYTE *)LiveDumpContext + 80) & 2) != 0 )
    v3 = 261;
  IopLiveDumpTraceInterfaceEnd(v4, 1i64, (unsigned int)v3);
  if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
  {
    v5 = *((_QWORD *)LiveDumpContext + 70);
    v15 = 0;
    v14 = 8;
    v6 = *(_QWORD *)(v5 + 4000);
    v13 = &v10;
    v10 = v6;
    v18 = 0;
    v17 = 8;
    v16 = &v11;
    v11 = (*(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v2) / 0x2710ui64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C04498,
      (unsigned __int8 *)byte_140023765,
      (const _GUID *)LiveDumpContext + 54,
      (const _GUID *)LiveDumpContext + 53,
      4u,
      &v12);
  }
  EtwActivityIdControl(2ui64, (_GUID *)LiveDumpContext + 53);
  IopLiveDumpReleaseResources((INT64)LiveDumpContext, v7, v8);
  ExFreePoolWithTag(LiveDumpContext, 0x706D644Cu);
  return v3;
}

Referenced by: