IopLiveDumpCaptureMemoryPages

NTSTATUS __stdcall IopLiveDumpCaptureMemoryPages(_LIVEDUMP_CONTEXT *Context){
  _LIVEDUMP_CONTEXT *v2; 
  __int64 v3; 
  char v4; 
  bool v5; 
  _LIVEDUMP_CONTEXT v6; 
  int v7; 
  __int64 v8; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  _MM_MIRROR_DISPATCH MirrorDispatch[2]; 
  NTSTATUS(__stdcall *v18)(UINT64); 
  NTSTATUS(__stdcall *v19)(_LARGE_INTEGER, _LARGE_INTEGER); 
  __int128 v20; 
  _EVENT_DATA_DESCRIPTOR v21; 
  __int64 *v22; 
  int v23; 
  int v24; 
  __int64 *v25; 
  int v26; 
  int v27; 
  __int64 *v28; 
  int v29; 
  int v30; 
  __int64 *v31; 
  int v32; 
  int v33; 
  __int64 *v34; 
  int v35; 
  int v36; 
  __int64 *v37; 
  int v38; 
  int v39; 
  __int64 *v40; 
  int v41; 
  int v42; 

  v2 = Context + 76;
  v20 = 0i64;
  v3 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
  *(_QWORD *)MirrorDispatch = IopLiveDumpStartMirroringCallback;
  v18 = IopLiveDumpEndMirroringCallback;
  v19 = IopLiveDumpMirrorPhysicalMemoryCallback;
  v4 = Context[10] & 4;
  SaveSupervisorState = 1;
  v5 = v4 != 0;
  v6 = Context[20];
  DWORD2(v20) = v5 ? 657 : 593;
  if( (v6 & 0x20) != 0 )
    DWORD2(v20) = (v5 ? 657 : 593) | 0x100;
  v7 = MmDuplicateMemory(MirrorDispatch);
  if( (Context[20] & 0x80u) != 0 )
    *((_QWORD *)Context + 64) = (unsigned __int64)(1000i64 * *((_QWORD *)Context + 63)) / *(&stru_140C452E0 + 85);
  if( v7 < 0 || v7 == 258 )
  {
    if( (v2[2] & 1) != 0 )
      IopLiveDumpUncorralProcessors(v2, 1u);
    IopLiveDumpTraceMmDuplicateMemoryFailure((__int64)Context, v7);
    if( v7 == 258 )
    {
      Context[20] |= 0x40u;
      v7 = -1073740682;
    }
  }
  else
  {
    if( VslIsSecureKernelRunning() && (*((_QWORD *)Context + 87) || *((_QWORD *)Context + 88)) )
      VslFinalizeLiveDumpInSk((_QWORD *)Context + 24, (_QWORD *)Context + 25, (__int64)(Context + 36));
    *((_QWORD *)Context + 60) = (*(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart - v3) / 0x2710ui64;
    IopLiveDumpTraceCaptureMemoryPages();
  }
  SaveSupervisorState = 0;
  if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
  {
    v8 = *((_QWORD *)Context + 60);
    v24 = 0;
    v27 = 0;
    v30 = 0;
    v33 = 0;
    v36 = 0;
    v39 = 0;
    v42 = 0;
    v10 = v8;
    v22 = &v10;
    v11 = *((_QWORD *)Context + 61);
    v25 = &v11;
    v12 = *((_QWORD *)Context + 62);
    v28 = &v12;
    v13 = *((_QWORD *)Context + 64);
    v31 = &v13;
    v14 = *((_QWORD *)Context + 65);
    v34 = &v14;
    v15 = *((_QWORD *)Context + 66);
    v37 = &v15;
    v16 = *((_QWORD *)Context + 67);
    v40 = &v16;
    v23 = 8;
    v26 = 8;
    v29 = 8;
    v32 = 8;
    v35 = 8;
    v38 = 8;
    v41 = 8;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C04498,
      (unsigned __int8 *)&byte_140023C7F,
      (const _GUID *)Context + 54,
      (const _GUID *)Context + 53,
      9u,
      &v21);
  }
  return v7;
}

Referenced by:

IoCaptureLiveDump