LkmdTelCreateReport

_HANDLE __stdcall LkmdTelCreateReport(
        PWCHAR ReportType,
        UINT32 BugCheckCode,
        PVOID BugCheckParam1,
        PVOID BugCheckParam2,
        PVOID BugCheckParam3,
        PVOID BugCheckParam4){
  VOID **PoolWithTag; 
  VOID **v9; 
  VOID **v10; 
  int v11; 
  int v12; 
  NTSTATUS v13; 
  int v14; 
  int v15; 
  __int64 v17; 
  VOID *v18; 
  _CONTEXT ContextRecord; 

  memset(&ContextRecord, 0i64, sizeof(ContextRecord));
  v18 = 0i64;
  LODWORD(v17) = 0;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x88ui64, 1952531540i64);
  v9 = PoolWithTag;
  if( PoolWithTag )
  {
    memset(PoolWithTag, 0i64, 0x88u);
    v10 = ExAllocatePoolWithTag(0x200ui64, 0x40000ui64, 1952531540i64);
    *v9 = v10;
    if( v10 && RtlStringCbPrintfW((WCHAR *)v9 + 52, 0x20ui64, (WCHAR *)L"%ws") >= 0 )
    {
      LODWORD(v17) = 1;
      v11 = WerLiveKernelCreateReport(v9 + 13, &v17, &v18);
      v12 = v11;
      if( v11 < 0 )
      {
        DbgPrintEx(5u, 0, "LKMDTEL: WerLiveKernelCreateReport failed with status 0x%X\n", (unsigned int)v11);
        goto LABEL_10;
      }
      if( (_DWORD)v17 )
      {
        v9[12] = v18;
        RtlCaptureContext(&ContextRecord);
        v13 = KeCapturePersistentThreadState(
                (INT64)&ContextRecord,
                0i64,
                292i64,
                (INT64)BugCheckParam1,
                (INT64)BugCheckParam2,
                (INT64)BugCheckParam3,
                (INT64)BugCheckParam4,
                (INT64)*v9);
        if( v13 )
        {
          *((_DWORD *)v9 + 2) = v13;
LABEL_10:
          if( v12 >= 0 )
            return(int)v9;
        }
      }
      else
      {
        DbgPrintEx(5u, 1u, "LKMDTEL: WerPolicy is WerLiveKernelPolicyNoDump, no dump is allowed.\n");
      }
    }
    if( *v9 )
      ExFreePoolWithTag(*v9, 0x74614454u);
    ExFreePoolWithTag(v9, 0x74614454u);
    LODWORD(v9) = 0;
  }
  if( v18 )
  {
    v14 = WerLiveKernelCancelReport();
    if( v14 < 0 )
      DbgPrintEx(5u, 1u, "LKMDTEL: WerLiveCancelReport failed, status 0x%X\n", (unsigned int)v14);
    v15 = WerLiveKernelCloseHandle(v18);
    if( v15 < 0 )
      DbgPrintEx(5u, 1u, "LKMDTEL: WerLiveCancelReport failed, status 0x%X\n", (unsigned int)v15);
  }
  return(int)v9;
}

Referenced by: