KiTpSetupCompletion
NTSTATUS __stdcall KiTpSetupCompletion(ULONG_PTR rcx0, CHAR a2, VOID *a4, VOID *Size, UINT64 Sizea, CHAR *a6){
_EPROCESS *v9;
unsigned int v10;
int ImageData;
UINT64 v13;
UINT64 v14;
v9 = *(_EPROCESS **)&rcx0;
*(_OWORD *)a6 = 0i64;
*((_OWORD *)a6 + 1) = 0i64;
*((_QWORD *)a6 + 4) = 0i64;
v10 = 4096 - ((unsigned __int16)a4 & 0xFFF);
if( v10 > 0xF )
v10 = 15;
LODWORD(v13) = v10;
ImageData = KiTpReadImageData(*(_EPROCESS **)&rcx0, a2, a4, a6 + 6, v13);
if( ImageData >= 0 )
{
a6[5] = v10;
ImageData = KiTpParseInstruction(a6);
if( ImageData == -1073741306 )
{
if( v10 >= 0xF )
return ImageData;
LODWORD(v14) = 15;
*(_OWORD *)a6 = 0i64;
*((_OWORD *)a6 + 1) = 0i64;
*((_QWORD *)a6 + 4) = 0i64;
ImageData = KiTpReadImageData(v9, a2, a4, a6 + 6, v14);
if( ImageData < 0 )
return ImageData;
a6[5] = 15;
ImageData = KiTpParseInstruction(a6);
}
if( ImageData >= 0 )
memmove(Size, a6 + 6, Sizea);
}
return ImageData;
}Referenced by:
KeSetTracepoint