KdCopyDataBlock
VOID __stdcall KdCopyDataBlock(_KDDEBUGGER_DATA64 *DataBlock){
_DBGKD_DEBUG_DATA_HEADER64 *v1;
_KDDEBUGGER_DATA64 *v2;
int v3;
__int64 v4;
__int128 v5;
v1 = &KdDebuggerDataBlock;
v2 = DataBlock;
if( byte_140C50A70[0] )
{
v3 = 112;
do
{
*(unsigned __int64 *)((char *)&v1->List.Flink + (char *)DataBlock - (char *)&KdDebuggerDataBlock) = KiWaitAlways ^ _byteswap_uint64((unsigned __int64)byte_140C50A70 ^ __ROL8__(KiWaitNever ^ v1->List.Flink, KiWaitNever));
v1 = (_DBGKD_DEBUG_DATA_HEADER64 *)((char *)v1 + 8);
--v3;
}
while( v3 );
}
else
{
v4 = 7i64;
do
{
*(LIST_ENTRY64 *)v2 = v1->List;
*((_OWORD *)v2 + 1) = *(_OWORD *)&v1->OwnerTag;
*((_OWORD *)v2 + 2) = *(_OWORD *)&v1[1].List.Blink;
*((_OWORD *)v2 + 3) = v1[2].List;
*((_OWORD *)v2 + 4) = *(_OWORD *)&v1[2].OwnerTag;
*((_OWORD *)v2 + 5) = *(_OWORD *)&v1[3].List.Blink;
*((_OWORD *)v2 + 6) = v1[4].List;
v2 += 32;
v5 = *(_OWORD *)&v1[4].OwnerTag;
v1 = (_DBGKD_DEBUG_DATA_HEADER64 *)((char *)v1 + 128);
*((_OWORD *)v2 - 1) = v5;
--v4;
}
while( v4 );
}
}Referenced by:
IoFillTriageDumpBuffer
IopInitializeInMemoryDumpData
KdDecodeDataBlock
KeCapturePersistentThreadState