IopLoadCrashdumpDriver

NTSTATUS __stdcall IopLoadCrashdumpDriver(){
  NTSTATUS result; 
  __int64 v1; 
  __int64(__fastcall *v2)(_UNICODE_STRING **, _DWORD *); 
  __int64 v3; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING *v5; 
  __int64 v6; 
  NTSTATUS(__fastcall *v7)(_UNICODE_STRING *, _UNICODE_STRING *, _UNICODE_STRING *, int, INT64, INT64); 
  NTSTATUS(__stdcall *v8)(VOID *); 
  VOID(__stdcall *v9)(UINT64, VOID *, UINT64, UINT64 *, UINT64 *); 
  __int64 v10; 
  int v11; 
  int v12; 
  _UNICODE_STRING *v13; 
  INT64 v14; 
  INT64 v15; 

  v15 = 0i64;
  v6 = 0i64;
  v12 = 0;
  v14 = 0i64;
  DestinationString = 0i64;
  if( qword_140C50968 )
    return 0;
  RtlInitUnicodeString(&DestinationString, L"\\SystemRoot\\System32\\Drivers\\crashdmp.sys");
  result = MmLoadSystemImageEx(&DestinationString, 0i64, 0i64, 0x22ui64, (INT64)&v15, (INT64)&v14);
  if( result >= 0 )
  {
    LODWORD(v1) = RtlImageNtHeader(v14);
    if( !v1 )
      return -1073741823;
    v2 = (__int64(__fastcall *)(_UNICODE_STRING **, _DWORD *))(v14 + *(unsigned int *)(v1 + 40));
    v5 = &IoArcBootDeviceName;
    v13 = &PoHiberFileRoot;
    IopGetPhysicalMemoryBlock();
    v6 = v3;
    if( !v3 )
      return -1073741670;
    v7 = IopLoadCrashdmpImage;
    v8 = MmUnloadSystemImage;
    v10 = *(&stru_140C452E0 + 886);
    v9 = HvlGetEncryptedData;
    v11 = VslVsmEnabled ? ((HvlpFlags & 2) != 0) + 1 : 0;
    dword_140C509A0 = 1;
    dword_140C509A4 = 11;
    result = v2(&v5, &dword_140C509A0);
    if( result >= 0 )
    {
      qword_140C50968 = v15;
      Address = v14;
      return 0;
    }
  }
  return result;
}

Referenced by: