IopLiveDumpValidateParameters
NTSTATUS __stdcall IopLiveDumpValidateParameters(
_LIVEDUMP_CONTEXT *Context,
_IO_LIVEDUMP_CONTROL *Control,
UINT64 Interface,
INT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
__int64 v8;
NTSTATUS result;
unsigned int v12;
__int64 v13;
unsigned int v14;
__int64 v15;
v8 = 0i64;
if( !Control )
return -1073741811;
if( *Control != 1 )
return -1073741811;
if( (unsigned int)Control[1] < 0x30 )
return -1073741811;
v12 = Control[7];
if( v12 >= 2 )
return -1073741811;
Context[11] = v12;
if( *((_QWORD *)Control + 4) )
return -1073741811;
v13 = *((_QWORD *)Control + 5);
result = 0;
while( v13 )
{
if( *(_DWORD *)(v13 + 28) )
return -1073741811;
if( !*(_QWORD *)(v13 + 16) || !*(_DWORD *)(v13 + 24) )
{
result = -1073741811;
break;
}
v13 = *(_QWORD *)(v13 + 32);
}
if( result >= 0 )
{
*((_OWORD *)Context + 3) = *((_OWORD *)Control + 2);
v14 = Control[6];
if( v14 < 0x20 )
{
if( (v14 & 3) != 0 )
return -1073741822;
Context[10] = v14;
result = IopLiveDumpValidateDumpFileHandle(*((VOID **)Control + 1));
if( result < 0 )
{
*((_QWORD *)Context + 8) = 0i64;
}
else
{
*((_QWORD *)Context + 8) = *((_QWORD *)Control + 1);
result = IopLiveDumpValidateCancelObject(*((VOID **)Control + 2));
if( result >= 0 )
v8 = v15;
*((_QWORD *)Context + 9) = v8;
}
return result;
}
return -1073741811;
}
return result;
}Referenced by:
IoCaptureLiveDump