KdPullRemoteFileEx

NTSTATUS __fastcall KdPullRemoteFileEx(_UNICODE_STRING *FileName, INT64 a2, INT64 a3, INT64 a4, INT64 a5){
  UINT64 v8; 
  VOID **PoolWithTag; 
  int v11; 
  unsigned __int64 v12; 
  UINT64 v13; 
  VOID *v14; 
  UINT64 v15; 
  __int64 v16; 
  UINT64 *Completed; 
  UINT64 v18; 
  UINT64 v19; 
  UINT64 v20; 
  UINT64 v21; 
  VOID *Handle; 
  __int64 Length[2]; 

  Length[0] = 0i64;
  Handle = 0i64;
  if( !(_BYTE)KdDebuggerEnabled || (_BYTE)KdDebuggerNotPresent || KdPitchDebugger )
    return -1073740972;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x2000ui64, 1867080779i64);
  if( !PoolWithTag )
    return -1073741801;
  v11 = KdpCreateRemoteFile(&Handle, (UINT64 *)Length, FileName, v8, (UINT64)Completed, v18, v19, v20);
  if( v11 >= 0
    && (memmove(PoolWithTag, FileName->Buffer, FileName->Length),
        *((_WORD *)PoolWithTag + ((unsigned __int64)FileName->Length >> 1)) = 0,
        v12 = Length[0],
        DbgPrintEx(
          0,
          0,
          "KdPullRemoteFile(%p): About to overwrite %ls and preallocate to %I64x\n",
          KeGetCurrentThread(),
          (const wchar_t *)PoolWithTag,
          Length[0]),
        v11 = ((__int64(__fastcall *)(INT64, _UNICODE_STRING *, unsigned __int64))a2)(a5, FileName, v12),
        v11 >= 0)
    && (v13 = 0i64, v12) )
  {
    v14 = Handle;
    do
    {
      LODWORD(v21) = 0;
      v15 = (unsigned int)v12;
      if( v12 > 0x2000 )
        v15 = 0x2000i64;
      v11 = KdpReadRemoteFile(v14, v13, PoolWithTag, v15, &v21);
      if( v11 < 0 )
        break;
      v16 = (unsigned int)v21;
      if( !(_DWORD)v21 )
        break;
      v11 = ((__int64(__fastcall *)(INT64, UINT64, VOID **, _QWORD))a3)(a5, v13, PoolWithTag, (unsigned int)v21);
      if( v11 < 0 )
        break;
      v13 += v16;
      v12 -= v16;
    }
    while( v12 );
  }
  else
  {
    v14 = Handle;
  }
  if( v14 )
    KdpCloseRemoteFile(v14);
  ((void(__fastcall *)(INT64, _QWORD))a4)(a5, (unsigned int)v11);
  ExFreePoolWithTag(PoolWithTag, 0);
  return v11;
}

Referenced by: