PspRecordCrashedProcessIntoBlackbox

VOID __stdcall PspRecordCrashedProcessIntoBlackbox(INT64 a1){
  unsigned __int16 *v1; 
  int v2; 
  int v3; 
  VOID **PoolWithTag; 
  _DWORD *v5; 
  UINT64 OutputBufferLength; 
  __int64 InputBuffer[3]; 
  int v8; 
  int v9; 

  v1 = *(unsigned __int16 **)(a1 + 1472);
  InputBuffer[2] = 0i64;
  v2 = 0;
  v9 = 0;
  if( v1 )
  {
    if( *((_QWORD *)v1 + 1) )
    {
      v3 = *v1;
      if( (_WORD)v3 )
        v2 = v3 + 2;
    }
  }
  PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)(v2 + 8), 1648522064i64);
  v5 = PoolWithTag;
  if( PoolWithTag )
  {
    memset(PoolWithTag, 0i64, v2 + 8);
    *v5 = 1;
    v5[1] = v2 + 8;
    if( v2 )
      memmove(v5 + 2, *((const VOID **)v1 + 1), *v1);
    v8 = 13;
    InputBuffer[0] = (__int64)v5;
    InputBuffer[1] = (unsigned int)(v2 + 8);
    LODWORD(OutputBufferLength) = 0;
    ZwPowerInformation(
      PowerInformationLevelMaximum|SystemPowerCapabilities,
      InputBuffer,
      0x20ui64,
      0i64,
      OutputBufferLength);
    ExFreePoolWithTag(v5, 0x62427350u);
  }
}

Referenced by: