SecureDump_Get_SecureDumpHeader
NTSTATUS __stdcall SecureDump_Get_SecureDumpHeader(INT64 a1, INT64 a2, UINT64 a3){
__int64 v5;
int v6;
unsigned int v7;
int v8;
if( !byte_140C4C594 )
return -1073741811;
if( (unsigned int)a3 < dword_140C4C5E0 )
return -1073741811;
v5 = (unsigned int)a3;
if( (unsigned int)a3 < pcbResult + (unsigned __int64)HIDWORD(dwFlags) + 4184 )
return -1073741811;
memset((VOID *)a2, 0i64, a3);
*(_DWORD *)(a2 + 8) = 1;
*(_DWORD *)(a2 + 12) = dword_140C4C5E0;
*(_DWORD *)a2 = *(_DWORD *)a1;
*(_DWORD *)(a2 + 4) = *(_DWORD *)(a1 + 4);
*(_DWORD *)(a2 + 48) = *(_DWORD *)(a1 + 48);
*(_DWORD *)(a2 + 3992) = *(_DWORD *)(a1 + 3992);
*(_QWORD *)(a2 + 4000) = (*(_QWORD *)(a1 + 4000) + v5 + 4095) & 0xFFFFFFFFFFFFF000ui64;
*(_DWORD *)(a2 + 4176) = *(_DWORD *)(a1 + 4176) | 0x100;
v6 = *(_DWORD *)(a1 + 56);
*(_QWORD *)(a2 + 64) = 0i64;
*(_QWORD *)(a2 + 72) = 0i64;
*(_QWORD *)(a2 + 80) = 0i64;
*(_QWORD *)(a2 + 88) = 0i64;
*(_DWORD *)(a2 + 56) = v6;
*(_DWORD *)(a2 + 20) = 4184;
*(_DWORD *)(a2 + 16) = pcbResult;
memmove((VOID *)(a2 + 4184), qword_140C4C5B8, pcbResult);
v7 = *(_DWORD *)(a2 + 16) + *(_DWORD *)(a2 + 20);
*(_DWORD *)(a2 + 40) = pbInput;
v8 = dword_140C4C5D8;
*(_DWORD *)(a2 + 28) = v7;
*(_DWORD *)(a2 + 32) = v8;
*(_DWORD *)(a2 + 24) = HIDWORD(dwFlags);
memmove((VOID *)(a2 + v7), (const VOID *)*(&dwFlags + 1), HIDWORD(dwFlags));
*(_DWORD *)(a2 + 36) = dword_140C4C5DC;
return 0;
}Referenced by:
IopLiveDumpWriteDumpFile
IopLiveDumpWriteDumpFileWithExtraPages