IopLiveDumpAllocateFromVMMemoryPartition

UINT64 __stdcall IopLiveDumpAllocateFromVMMemoryPartition(INT64 a1, UINT64 a2, _MDL **a3){
  int v3; 
  VOID *MappedSystemVa; 
  _MDL *PartitionNodePagesForMdl; 
  VOID **v7; 
  int v8; 
  VOID *v9; 
  unsigned int v10; 
  int v11; 
  int v12; 
  PVOID *Object; 
  UINT64 Priority; 
  UINT64 Prioritya; 
  UINT64 Flags; 
  UINT64 Flagsa; 
  bool v19; 
  PVOID v20; 
  UINT64 TotalBytes; 
  _MDL **v22; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _EVENT_DATA_DESCRIPTOR v25[2]; 
  bool *v26; 
  int v27; 
  int v28; 
  PVOID *v29; 
  int v30; 
  int v31; 

  v3 = *(_DWORD *)(a1 + 80);
  MappedSystemVa = 0i64;
  v22 = a3;
  PartitionNodePagesForMdl = 0i64;
  TotalBytes = a2;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  if( (v3 & 0xC) != 0 )
    return 0i64;
  v7 = (VOID **)(a1 + 992);
  if( *(_QWORD *)(a1 + 992) )
    goto LABEL_5;
  RtlInitUnicodeString(&DestinationString, L"\\KernelObjects\\MemoryPartitionHyperV");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v8 = ZwOpenPartition(v7, 2ui64, &ObjectAttributes);
  if( v8 < 0 )
    goto LABEL_14;
  v9 = *v7;
  v20 = 0i64;
  v8 = ObReferenceObjectByHandle(v9, 2ui64, PsPartitionType, 0, &v20, 0i64);
  *(_QWORD *)(a1 + 1000) = v20;
  if( v8 >= 0 )
  {
LABEL_5:
    v10 = BufferChunkSizeInBytes;
    LODWORD(Flags) = 101;
    LODWORD(Priority) = 0;
    PartitionNodePagesForMdl = MmAllocatePartitionNodePagesForMdlEx(
                                 0i64,
                                 (_LARGE_INTEGER)-1i64,
                                 (_LARGE_INTEGER)(unsigned int)BufferChunkSizeInBytes,
                                 TotalBytes,
                                 MmCached,
                                 Priority,
                                 Flags,
                                 *(VOID **)(a1 + 1000));
    if( PartitionNodePagesForMdl
      || (LODWORD(Flagsa) = 37,
          LODWORD(Prioritya) = 0,
          (PartitionNodePagesForMdl = MmAllocatePartitionNodePagesForMdlEx(
                                        0i64,
                                        (_LARGE_INTEGER)-1i64,
                                        (_LARGE_INTEGER)v10,
                                        TotalBytes,
                                        MmCached,
                                        Prioritya,
                                        Flagsa,
                                        *(VOID **)(a1 + 1000))) != 0i64) )
    {
      if( (PartitionNodePagesForMdl->MdlFlags & 5) != 0 )
      {
        MappedSystemVa = PartitionNodePagesForMdl->MappedSystemVa;
      }
      else
      {
        LODWORD(Prioritya) = 1073741856;
        LODWORD(Object) = 0;
        MappedSystemVa = MmMapLockedPagesSpecifyCache(
                           PartitionNodePagesForMdl,
                           0,
                           MmCached,
                           0i64,
                           (UINT64)Object,
                           Prioritya);
      }
    }
    else
    {
      *(_DWORD *)(a1 + 80) |= 8u;
      IopLiveDumpTraceAllocationFromVMMemoryPartitionFailure();
      if( (unsigned int)dword_140C04498 > 5 )
      {
        if( tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
        {
          v11 = *(_DWORD *)(a1 + 80);
          v28 = 0;
          v31 = 0;
          v27 = 1;
          v19 = (v11 & 8) != 0;
          v26 = &v19;
          v29 = &v20;
          LODWORD(v20) = -1073741801;
          v30 = 4;
          tlgWriteTransfer_EtwWriteTransfer(
            (__int64)&dword_140C04498,
            (unsigned __int8 *)byte_140023703,
            (const _GUID *)(a1 + 864),
            (const _GUID *)(a1 + 848),
            4u,
            v25);
        }
      }
    }
  }
  else
  {
LABEL_14:
    *(_DWORD *)(a1 + 80) |= 4u;
    IopLiveDumpTraceOpenVMMemoryPartitionFailure(a1, v8);
    if( (unsigned int)dword_140C04498 > 5 && tlgKeywordOn((__int64)&dword_140C04498, 0x200000000000i64) )
    {
      v12 = *(_DWORD *)(a1 + 80);
      v28 = 0;
      v31 = 0;
      v27 = 1;
      v19 = (v12 & 4) != 0;
      v26 = &v19;
      v29 = &v20;
      LODWORD(v20) = v8;
      v30 = 4;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&dword_140C04498,
        (unsigned __int8 *)byte_1400236B5,
        (const _GUID *)(a1 + 864),
        (const _GUID *)(a1 + 848),
        4u,
        v25);
    }
  }
  if( PartitionNodePagesForMdl )
  {
    if( !MappedSystemVa )
    {
      MmFreePagesFromMdl(PartitionNodePagesForMdl);
      ExFreePoolWithTag(PartitionNodePagesForMdl, 0);
      return 0i64;
    }
    *v22 = PartitionNodePagesForMdl;
  }
  return(UINT64)MappedSystemVa;
}

Referenced by: