LkmdTelpWriteDumpFile

NTSTATUS __stdcall LkmdTelpWriteDumpFile(INT64 a1){
  __int64 v2; 
  int v3; 
  int v4; 
  int v5; 
  __int128 v6; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int64 FileHandle; 

  v2 = *(_QWORD *)(a1 + 96);
  IoStatusBlock = 0i64;
  FileHandle = 0i64;
  v3 = WerLiveKernelOpenDumpFile(v2, &FileHandle);
  v4 = v3;
  if( v3 >= 0 )
  {
    v5 = *(_DWORD *)(a1 + 24);
    if( v5 && *(_QWORD *)(a1 + 16) )
    {
      *(_QWORD *)(*(_QWORD *)a1 + 4000i64) = (unsigned int)(v5 + 262192);
      *(_DWORD *)(a1 + 44) = 1886221636;
      *(_DWORD *)(a1 + 48) = 1651469378;
      *(_DWORD *)(a1 + 52) = 16;
      *(_DWORD *)(a1 + 56) = NtBuildNumber;
      *(_DWORD *)(a1 + 60) = 32;
      v6 = *(_OWORD *)(a1 + 28);
      *(_QWORD *)(a1 + 84) = 0i64;
      *(_OWORD *)(a1 + 64) = v6;
      *(_DWORD *)(a1 + 80) = *(_DWORD *)(a1 + 24);
    }
    v4 = ZwWriteFile(FileHandle, 0, 0i64, 0i64, &IoStatusBlock, *(PVOID *)a1, *(_DWORD *)(a1 + 8), 0i64, 0i64);
    if( v4 >= 0 )
    {
      if( *(_DWORD *)(a1 + 24) )
      {
        v4 = ZwWriteFile(FileHandle, 0, 0i64, 0i64, &IoStatusBlock, (PVOID)(a1 + 44), 0x10u, 0i64, 0i64);
        if( v4 >= 0 )
        {
          v4 = ZwWriteFile(FileHandle, 0, 0i64, 0i64, &IoStatusBlock, (PVOID)(a1 + 60), 0x20u, 0i64, 0i64);
          if( v4 >= 0 )
            v4 = ZwWriteFile(
                   FileHandle,
                   0,
                   0i64,
                   0i64,
                   &IoStatusBlock,
                   *(PVOID *)(a1 + 16),
                   *(_DWORD *)(a1 + 24),
                   0i64,
                   0i64);
        }
      }
    }
  }
  else
  {
    DbgPrintEx(
      5u,
      0,
      "LKMDTEL: LkmdTelpWriteDumpFile: WerLiveKernelOpenDumpFile failed, status 0x%X\n",
      (unsigned int)v3);
  }
  if( FileHandle )
    ZwClose(FileHandle);
  return v4;
}

Referenced by: