IopInitializeInMemoryDumpData

VOID __stdcall IopInitializeInMemoryDumpData(){
  __int64 v0; 
  char v1; 
  NTSTATUS v2; 
  VOID **v3; 
  char *v4; 
  unsigned int v5; 
  VOID *ContiguousNodeMemory; 
  __int64 v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  NTSTATUS v10; 
  UINT64 DataSize; 
  UINT64 DataSizea; 
  UINT64 PreferredNode; 
  char Data[8]; 
  __int128 v15; 
  __int64 v16; 
  _GUID VendorGuid; 

  VendorGuid.Data1 = 2012912317;
  *(_DWORD *)&VendorGuid.Data2 = 1295123289;
  *(_DWORD *)VendorGuid.Data4 = -198680387;
  *(_DWORD *)&VendorGuid.Data4[4] = 1266192359;
  Data[0] = 0;
  *(_QWORD *)&v15 = 0x302E4594353594B3i64;
  v0 = 2i64;
  *((_QWORD *)&v15 + 1) = 0xB50211F197DACBD4ui64;
  v16 = 0x199B7088610836E8i64;
  if( _InterlockedExchange(dword_140C50910, 1) != 1 )
  {
    dword_140C50944 = 0;
    dword_140C50930[0] = 0;
    LODWORD(DataSize) = 1;
    v1 = 0;
    v2 = ZwFilterBootOption(FilterBootOptionOperationSetElement, 0x10200003ui64, 0x260000A0ui64, Data, DataSize);
    if( v2 >= 0 || v2 == -2143092730 && (_BYTE)KdDebuggerEnabled )
      v1 = 1;
    v3 = (VOID **)&unk_140C50918;
    NumberOfBytes = 9112i64;
    v4 = (char *)&unk_140C50918;
    v5 = 0;
    while( 1 )
    {
      LODWORD(PreferredNode) = 0x80000000;
      LODWORD(DataSizea) = 4;
      ContiguousNodeMemory = MmAllocateContiguousNodeMemory(
                               NumberOfBytes,
                               0i64,
                               (_LARGE_INTEGER)-1i64,
                               0i64,
                               DataSizea,
                               PreferredNode);
      *(_QWORD *)v4 = ContiguousNodeMemory;
      if( !ContiguousNodeMemory )
        break;
      memset(ContiguousNodeMemory, 0i64, NumberOfBytes);
      v7 = *(_QWORD *)v4;
      *(_OWORD *)v7 = v15;
      *(_QWORD *)(v7 + 16) = v16;
      if( v1 )
        KdCopyDataBlock((_KDDEBUGGER_DATA64 *)(*(_QWORD *)v4 + 8216i64));
      ++v5;
      v4 += 8;
      if( v5 >= 2 )
      {
        v8 = __rdtsc();
        LODWORD(qword_140C50938) = v8;
        v9 = __rdtsc();
        HIDWORD(qword_140C50938) = v9;
        LODWORD(DataSizea) = 7;
        HIDWORD(qword_140C50938) = ExGenRandom(ExGenRandomDomainUserVisible) & 0x7FFFFFFF;
        v10 = IoSetEnvironmentVariableEx((WCHAR *)L"DumpInstance", &VendorGuid, &qword_140C50938, 8ui64, DataSizea);
        if( v10 < 0 )
        {
          dword_140C50944 = v10;
          qword_140C50938 = 0x4547415045474150i64;
        }
        dword_140C50914 = 1;
        goto LABEL_18;
      }
    }
    dword_140C50944 = -1073741801;
    do
    {
      if( *v3 )
      {
        MmFreeContiguousMemory(*v3);
        *v3 = 0i64;
      }
      ++v3;
      --v0;
    }
    while( v0 );
LABEL_18:
    _InterlockedExchange(dword_140C50910, 0);
  }
}

Referenced by: