KiInvokeBugCheckAddTriageDumpDataCallbacks
INT8 __stdcall KiInvokeBugCheckAddTriageDumpDataCallbacks(){
INT64 v0;
__int64 v1;
INT64 v2;
INT64 *v3;
INT64 v5[2];
__int128 v6;
__int128 v7;
UINT64 v8;
_LIST_ENTRY *PreviousValidEntry;
__int64 v10;
__int64 v11;
LOBYTE(v0) = 0;
*(_OWORD *)v5 = 0i64;
v6 = 0i64;
v7 = 0i64;
v8 = 0i64;
v11 = (__int64)&KiSwapEvent + 368;
v1 = *(&KiSwapEvent + 46);
if( *(&KiSwapEvent + 46) && *(&KiSwapEvent + 47) )
{
PreviousValidEntry = (_LIST_ENTRY *)((char *)&KiSwapEvent + 368);
while( 1 )
{
v10 = v1;
if( (_UNKNOWN *)v1 == (_UNKNOWN *)((char *)&KiSwapEvent + 368) )
break;
LOBYTE(v0) = KeValidateBugCheckCallbackRecord(
(_KBUGCHECK_REASON_CALLBACK_RECORD *)v1,
KbCallbackRemovePages|KbCallbackReserved1,
&PreviousValidEntry);
if( (_BYTE)v0 )
{
v5[0] = 0i64;
v5[1] = 0x200000000000001i64;
LODWORD(v6) = KiBugCheckData;
*((_QWORD *)&v6 + 1) = *(&KiBugCheckData + 1);
v7 = *(_OWORD *)&INT64;
v8 = a5;
LOBYTE(v0) = (*(__int64(__fastcall **)(__int64, __int64, INT64 *))(v1 + 16))(7i64, v1, v5);
if( v5[0]
&& (LOBYTE(v0) = KiValidateTriageDumpDataArray(v5[0], v2, 0x2000000ui64), (_BYTE)v0)
&& (LOBYTE(v0) = KiValidateComponentName(*(STRSAFE_PCNZCH *)(v1 + 24)), (_BYTE)v0) )
{
*(_QWORD *)(v5[0] + 40) = *(_QWORD *)(v1 + 24);
*(_DWORD *)(v5[0] + 32) = 1;
v0 = v5[0];
v3 = (INT64 *)*(&KiSwapEvent + 49);
if( (_UNKNOWN *)**(&KiSwapEvent + 49) != (_UNKNOWN *)((char *)&KiSwapEvent + 384) )
__fastfail(3u);
*(_QWORD *)v5[0] = (char *)&KiSwapEvent + 384;
*(_QWORD *)(v0 + 8) = v3;
*v3 = v0;
*(&KiSwapEvent + 49) = v0;
*(_BYTE *)(v1 + 44) = 3;
}
else
{
*(_BYTE *)(v1 + 44) = 4;
}
}
else if( !PreviousValidEntry )
{
return v0;
}
v1 = *(_QWORD *)v1;
}
}
return v0;
}Referenced by:
KeBugCheck2