IopLiveDumpAllocateDumpBuffers
INT64 __fastcall IopLiveDumpAllocateDumpBuffers(INT64 a1){
__int64 v1;
INT64 MillisecondCounter;
unsigned __int64 v4;
unsigned __int64 *v5;
__int64 v6;
__int64 v7;
unsigned __int64 v8;
__int64 v9;
unsigned __int64 v10;
unsigned __int64 v11;
int v12;
unsigned __int64 v13;
unsigned __int64 v14;
VOID *PoolWithTag;
unsigned int v16;
VOID *v17;
char v18;
__int64 v19;
int v20;
MDL *v21;
UINT64 IndependentPages;
int v23;
UINT64 v24;
void *v25;
__int64 v26;
unsigned __int64 v27;
unsigned __int64 v28;
__int64 v29;
__int64 v30;
MDL *v32;
v1 = 0i64;
MillisecondCounter = 0i64;
if( (*(_DWORD *)(a1 + 80) & 0x80u) != 0 )
MillisecondCounter = IopLiveDumpGetMillisecondCounter(0);
v4 = (unsigned int)BufferChunkSizeInPages;
v5 = (unsigned __int64 *)(a1 + 680);
*(_QWORD *)(a1 + 712) = 0i64;
*(_QWORD *)(a1 + 744) = 0i64;
*(_QWORD *)(a1 + 680) = 0i64;
v6 = *(_QWORD *)(a1 + 96);
v7 = ~(v4 - 1);
v8 = v7 & (*(_QWORD *)(a1 + 120) + v4 - 1);
*(_QWORD *)(a1 + 104) = v7 & (v4 + *(_QWORD *)(a1 + 104) - 1i64);
v9 = *(_QWORD *)(a1 + 128) - 1i64;
*(_QWORD *)(a1 + 120) = v8;
v10 = v7 & (v4 + v6 - 1);
v11 = v7 & (v4 + v9);
*(_QWORD *)(a1 + 96) = v10;
*(_QWORD *)(a1 + 128) = v11;
v12 = *(_DWORD *)(a1 + 80);
v13 = v10 / v4 + v8 / v4 + v11 / v4;
if( (v12 & 0x200) != 0 )
{
v14 = (*(_QWORD *)(a1 + 1048) >> 12) + ((*(_QWORD *)(a1 + 1048) & 0xFFFi64) != 0);
if( v13 * (unsigned int)v4 > v14 )
{
*(_DWORD *)(a1 + 80) = v12 | 0x400;
v13 = (v7 & v14) / v4;
}
}
PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, (8 * v13 + 4095) & 0xFFFFFFFFFFFFF000ui64, 0x706D644Cui64);
*(_QWORD *)(a1 + 752) = PoolWithTag;
if( !PoolWithTag )
goto LABEL_35;
if( IopLiveDumpIsUnderMemoryPressure(*(KEVENT **)(a1 + 824), *(KEVENT **)(a1 + 832)) )
goto LABEL_8;
v17 = ExAllocatePoolWithTag(NonPagedPoolNx, (8 * v13 + 4095) & 0xFFFFFFFFFFFFF000ui64, 0x706D644Cui64);
*(_QWORD *)(a1 + 760) = v17;
if( !v17 )
goto LABEL_35;
if( IopLiveDumpIsUnderMemoryPressure(*(KEVENT **)(a1 + 824), *(KEVENT **)(a1 + 832)) )
goto LABEL_8;
IopLiveDumpDiscardVirtualAddressRange();
memset(*(_QWORD *)(a1 + 752), 0i64);
IopLiveDumpDiscardVirtualAddressRange();
memset(*(_QWORD *)(a1 + 760), 0i64);
v18 = 0;
v19 = 0i64;
if( !v13 )
{
LABEL_31:
if( IopLiveDumpIsUnderMemoryPressure(*(KEVENT **)(a1 + 824), *(KEVENT **)(a1 + 832)) )
goto LABEL_8;
v27 = *v5;
v28 = *(_QWORD *)(a1 + 104);
if( *v5 >= v28 )
{
v16 = 0;
goto LABEL_37;
}
LABEL_35:
v16 = -1073741670;
goto LABEL_36;
}
while( 1 )
{
v20 = *(_DWORD *)(a1 + 1040);
v21 = 0i64;
v32 = 0i64;
if( ((v20 - 2) & 0xFFFFFFFD) == 0 && !v18 )
{
IndependentPages = MmAllocateIndependentPagesEx((unsigned int)BufferChunkSizeInBytes, 0xFFFFFFFFi64, 0i64, 0i64);
goto LABEL_17;
}
if( ((v20 - 1) & 0xFFFFFFFD) == 0 )
{
IndependentPages = IopLiveDumpAllocateFromVMMemoryPartition(a1, (unsigned int)BufferChunkSizeInBytes, &v32);
v21 = v32;
LABEL_17:
if( IndependentPages )
goto LABEL_24;
}
v23 = *(_DWORD *)(a1 + 1040);
if( (unsigned int)(v23 - 1) <= 1 )
goto LABEL_31;
if( v23 == 4 )
{
v24 = IopLiveDumpAllocateFromVMMemoryPartition(a1, (unsigned int)BufferChunkSizeInBytes, &v32);
v21 = v32;
}
else
{
if( v23 != 3 )
goto LABEL_31;
v24 = MmAllocateIndependentPagesEx((unsigned int)BufferChunkSizeInBytes, 0xFFFFFFFFi64, 0i64, 0i64);
}
if( !v24 )
goto LABEL_31;
LABEL_24:
if( !IopLiveDumpIsUnderMemoryPressure(*(KEVENT **)(a1 + 824), *(KEVENT **)(a1 + 832)) )
{
*(_QWORD *)(*(_QWORD *)(a1 + 752) + 8 * v19) = v25;
*v5 += (unsigned int)BufferChunkSizeInPages;
v26 = *(_QWORD *)(a1 + 760);
++*(_QWORD *)(a1 + 744);
*(_QWORD *)(v26 + 8 * v19) = v21;
IopLiveDumpDiscardVirtualAddressRange();
goto LABEL_30;
}
if( v21 )
break;
MmFreeIndependentPages(v25, (unsigned int)BufferChunkSizeInBytes);
if( v18 || *(_DWORD *)(a1 + 1040) != 4 )
goto LABEL_8;
--v19;
v18 = 1;
LABEL_30:
if( ++v19 >= v13 )
goto LABEL_31;
}
MmFreePagesFromMdl(v21);
ExFreePoolWithTag(v21, 0);
LABEL_8:
v16 = -1073741248;
LABEL_36:
IopLiveDumpFreeDumpBuffers(a1 + 680);
*v5 = 0i64;
v27 = 0i64;
v28 = *(_QWORD *)(a1 + 104);
LABEL_37:
v29 = *(_QWORD *)(a1 + 128);
v30 = *(_QWORD *)(a1 + 120);
if( v27 < v28 + v29 + v30 )
{
if( v27 )
{
*(_QWORD *)(a1 + 688) = v28;
*(_QWORD *)(a1 + 696) = v27 - v28;
}
else
{
*(_QWORD *)(a1 + 688) = 0i64;
*(_QWORD *)(a1 + 696) = 0i64;
}
}
else
{
*(_QWORD *)(a1 + 688) = v27 - v29 - v30;
*(_QWORD *)(a1 + 696) = *(_QWORD *)(a1 + 120);
v1 = *(_QWORD *)(a1 + 128);
}
*(_QWORD *)(a1 + 704) = v1;
if( (*(_DWORD *)(a1 + 80) & 0x80u) != 0 )
*(_QWORD *)(a1 + 768) = IopLiveDumpGetMillisecondCounter(0) - MillisecondCounter;
IopLiveDumpTraceEstimatedAndAllocatedPageCount(a1, v13 * (unsigned int)BufferChunkSizeInPages);
return v16;
}Referenced by:
IopLiveDumpAllocAndInitResources