IopInitializeOfflineCrashDump

VOID __stdcall IopInitializeOfflineCrashDump(_LOADER_PARAMETER_EXTENSION *LdrBlckExtension){
  int v1; 
  NTSTATUS v2; 
  char v3; 
  _BYTE *v4; 
  INT64 v5; 
  UINT64 Create; 
  char v7; 
  char Value[7]; 
  VOID *Handle; 
  _KEY_VALUE_FULL_INFORMATION *Information; 
  UINT64 ValueLength; 
  _UNICODE_STRING KeyName; 
  _GUID VendorGuid; 

  Information = 0i64;
  v1 = 0;
  VendorGuid.Data1 = 2012912317;
  Handle = 0i64;
  dword_140C50940 = 0;
  *(_DWORD *)&VendorGuid.Data2 = 1295123289;
  *(_DWORD *)VendorGuid.Data4 = -198680387;
  *(_DWORD *)&VendorGuid.Data4[4] = 1266192359;
  *(_QWORD *)&KeyName.Length = 8388734i64;
  KeyName.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CrashControl";
  Value[0] = 0;
  LODWORD(ValueLength) = 1;
  v7 = 0;
  if( LdrBlckExtension )
  {
    if( LdrBlckExtension->OfflineCrashdumpConfigurationTable.Version - 1 <= 1 )
    {
      *(_OWORD *)((char *)&stru_140C23628 + 6136) = *(_OWORD *)&LdrBlckExtension->OfflineCrashdumpConfigurationTable.Version;
      *(_OWORD *)((char *)&stru_140C23628 + 6152) = *(_OWORD *)&LdrBlckExtension->OfflineCrashdumpConfigurationTable.ResetDataAddress.anonymous_0.LowPart;
      v2 = IopOpenRegistryKey(&Handle, 0i64, &KeyName, 0x20019ui64, 0);
      if( v2 >= 0 )
      {
        if( IopGetRegistryValue(Handle, (PWCHAR)L"EnableOfflineDumps", 0i64, &Information) < 0 )
          goto LABEL_14;
        if( Information->DataLength )
          v1 = *(ULONG *)((char *)&Information->TitleIndex + Information->DataOffset);
        ExFreePoolWithTag(Information, 0);
        if( v1 == 1 )
        {
          OfflineDumpEnabled = 1;
          v7 = 1;
        }
        else
        {
LABEL_14:
          OfflineDumpEnabled = 0;
          if( *(&stru_140C23628 + 1534) >= 2u )
          {
            v3 = v7;
            if( (*(&stru_140C23628 + 6144) & 4) != 0 )
              v3 = 4;
            v7 = v3;
          }
        }
        if( IoGetEnvironmentVariableEx(
               (WCHAR *)L"OfflineMemoryDumpUseCapability",
               &VendorGuid,
               Value,
               &ValueLength,
               0i64) < 0
          || Value[0] != v7 )
        {
          LODWORD(Create) = 7;
          IoSetEnvironmentVariableEx((WCHAR *)L"OfflineMemoryDumpUseCapability", &VendorGuid, &v7, 1ui64, Create);
        }
        if( OfflineDumpEnabled )
        {
          IopCachePreviousBootData(&Handle);
          IopInitializeInMemoryDumpData();
          IopConstructInMemoryDumpHeader(v5, v4);
          if( IopGetRegistryValue(Handle, (PWCHAR)L"AttemptOffline", 0i64, &Information) >= 0 )
          {
            if( Information->DataLength )
              DumpPolicyAttemptOffline = *(ULONG *)((char *)&Information->TitleIndex + Information->DataOffset);
            ExFreePoolWithTag(Information, 0);
          }
        }
      }
      else
      {
        dword_140C50940 = v2;
      }
    }
    else
    {
      dword_140C50940 = -1073741736;
    }
    if( Handle )
      ObCloseHandle(Handle, 0);
  }
  else
  {
    dword_140C50940 = -1073741275;
  }
}

Referenced by: