IopMarkPagesForProcessorData
NTSTATUS __stdcall IopMarkPagesForProcessorData(_MM_KERNEL_DUMP_CONTEXT *Context, UINT64 a2){
__int64 v3;
NTSTATUS result;
v3 = (__int64)*(&KiProcessorBlock + (unsigned int)a2);
result = MmAddRangeToCrashDump(Context, (VOID *)(v3 - 384), 0xB080ui64);
if( result >= 0 )
{
result = MmAddRangeToCrashDump(Context, *(VOID **)(v3 + 8), 0x898ui64);
if( result >= 0 )
{
result = MmAddRangeToCrashDump(Context, *(VOID **)(*(_QWORD *)(v3 + 8) + 184i64), 0xA40ui64);
if( result >= 0 )
{
result = MmAddRangeToCrashDump(Context, *(VOID **)(v3 + 34240), 0x4D0ui64);
if( result >= 0 )
{
result = MmAddRangeToCrashDump(Context, *(VOID **)(*(_QWORD *)(v3 + 34240) + 152i64), 0x2000ui64);
if( result >= 0 )
{
result = MmAddRangeToCrashDump(
Context,
(VOID *)(*(_QWORD *)(*(_QWORD *)(v3 + 34240) + 248i64) - 4096i64),
0x2000ui64);
if( result >= 0 )
{
result = MmAddRangeToCrashDump(Context, *(VOID **)(v3 + 344), *(unsigned __int16 *)(v3 + 342));
if( result >= 0 )
return MmAddRangeToCrashDump(Context, *(VOID **)(v3 + 360), *(unsigned __int16 *)(v3 + 358));
}
}
}
}
}
}
return result;
}Referenced by:
IopAddLiveDumpPagesToPartialKernelDump