LkmdTelInsertTriageDataBlock

NTSTATUS __stdcall LkmdTelInsertTriageDataBlock(_HANDLE TelemetryHandle, PVOID TriageData, UINT32 TriageDataSize){
  NTSTATUS v3; 
  __int64 v7; 
  unsigned int v8; 
  __int64 v9; 
  unsigned int v10; 
  unsigned int v11; 
  unsigned int v12; 
  _DWORD *v13; 
  unsigned int v14; 
  unsigned int v15; 
  UINT32 v16; 
  unsigned int v17; 
  unsigned int v18; 
  __int64 v19; 
  unsigned int v20; 

  v3 = 0;
  if( !TriageDataSize )
    return -1073741811;
  v7 = **(_QWORD **)&TelemetryHandle;
  if( (*(_DWORD *)(**(_QWORD **)&TelemetryHandle + 4152i64) & 0x800) != 0 )
  {
    v8 = *(_DWORD *)(v7 + 8316);
    if( v8 )
    {
      v9 = *(unsigned int *)(v7 + 8312);
      if( v9 + 16 * (unsigned __int64)v8 <= 0x40000 )
      {
        v10 = 0x40000;
        v11 = 0;
        v12 = 0;
        v13 = (_DWORD *)(v9 + v7 + 12);
        while( 1 )
        {
          v14 = *(v13 - 1);
          if( v14 != ((v14 + 7) & 0xFFFFFFF8) )
            break;
          v15 = (*v13 + v14 + 7) & 0xFFFFFFF8;
          if( v14 >= v10 )
            v14 = v10;
          v10 = v14;
          if( v15 <= v11 )
            v15 = v11;
          v13 += 4;
          ++v12;
          v11 = v15;
          if( v12 >= v8 )
          {
            v16 = 262140 - v15;
            if( 262140 - v11 >= 0x40000 || ((TriageDataSize + 7) & 0xFFFFFFF8) + 16 > v16 )
              return -1073741789;
            memmove((VOID *)(v7 + v14 + 16), (const VOID *)(v7 + v14), v11 - v14);
            v17 = 0;
            v18 = *(_DWORD *)(v7 + 8316);
            v19 = v7 + *(unsigned int *)(v7 + 8312);
            if( v18 )
            {
              do
              {
                *(_DWORD *)(v19 + 8) += 16;
                ++v17;
                v18 = *(_DWORD *)(v7 + 8316);
                v19 += 16i64;
              }
              while( v17 < v18 );
            }
            v20 = v11 + 16;
            *(_DWORD *)(v7 + 8316) = v18 + 1;
            *(_QWORD *)v19 = TriageData;
            *(_DWORD *)(v19 + 8) = v20;
            *(_DWORD *)(v19 + 12) = TriageDataSize;
            memmove((VOID *)(v7 + v20), TriageData, TriageDataSize);
            return v3;
          }
        }
      }
    }
  }
  return -1073741811;
}

Referenced by:

WheapReportLiveDump