IopLiveDumpAddTriageDumpData

NTSTATUS __fastcall IopLiveDumpAddTriageDumpData(INT64 *rcx0, INT64 a2){
  _KBUGCHECK_REASON_CALLBACK_RECORD *Flink; 
  NTSTATUS result; 
  int v6; 
  INT64 v7; 
  INT64 v8; 
  __int64 i; 
  VOID *v10; 
  UINT64 v11; 
  INT64 v12[2]; 
  __int128 v13; 
  __int128 v14; 
  INT64 v15; 
  _LIST_ENTRY *PreviousValidEntry; 

  Flink = (_KBUGCHECK_REASON_CALLBACK_RECORD *)*(&KiSwapEvent + 46);
  result = 0;
  v15 = 0i64;
  *(_OWORD *)v12 = 0i64;
  v13 = 0i64;
  v14 = 0i64;
  if( *(&KiSwapEvent + 46) && *(&KiSwapEvent + 47) )
  {
    PreviousValidEntry = (_LIST_ENTRY *)((char *)&KiSwapEvent + 368);
    while( Flink != (_KBUGCHECK_REASON_CALLBACK_RECORD *)((char *)&KiSwapEvent + 368) )
    {
      LOBYTE(result) = KeValidateBugCheckCallbackRecord(
                         Flink,
                         KbCallbackRemovePages|KbCallbackReserved1,
                         &PreviousValidEntry);
      if( (_BYTE)result )
      {
        v6 = *(_DWORD *)rcx0;
        v12[0] = 0i64;
        LODWORD(v13) = v6;
        *((_QWORD *)&v13 + 1) = rcx0[1];
        v14 = *((_OWORD *)rcx0 + 1);
        v15 = rcx0[4];
        HIDWORD(v12[1]) = 0x2000000;
        result = ((__int64(__fastcall *)(__int64, _KBUGCHECK_REASON_CALLBACK_RECORD *, INT64 *))Flink->CallbackRoutine)(
                   7i64,
                   Flink,
                   v12);
        if( v12[0] )
        {
          LOBYTE(result) = KiValidateTriageDumpDataArray(v12[0], v7, 0x2000000ui64);
          if( (_BYTE)result )
          {
            result = KiValidateComponentName((STRSAFE_PCNZCH)Flink->Component);
            if( (_BYTE)result )
            {
              result = v12[0];
              if( *(_DWORD *)(v12[0] + 16) )
              {
                result = MmAddRangeToCrashDump((_MM_KERNEL_DUMP_CONTEXT *)a2, Flink->Component, 1ui64);
                v8 = v12[0];
                for( i = 0i64; (unsigned int)i < *(_DWORD *)(v8 + 16); i = (unsigned int)(i + 1) )
                {
                  result = 2 * (i + 3);
                  v10 = *(VOID **)(v8 + 16 * (i + 3));
                  if( v10 )
                  {
                    v11 = *(_QWORD *)(v8 + 16i64 * (unsigned int)i + 56);
                    if( v11 )
                    {
                      result = MmAddRangeToCrashDump((_MM_KERNEL_DUMP_CONTEXT *)a2, v10, v11);
                      v8 = v12[0];
                    }
                  }
                }
              }
            }
          }
        }
      }
      else if( !PreviousValidEntry )
      {
        return result;
      }
      Flink = (_KBUGCHECK_REASON_CALLBACK_RECORD *)Flink->Entry.Flink;
    }
  }
  return result;
}

Referenced by: