IopInitializeCrashDump
UINT8 __stdcall IopInitializeCrashDump(PVOID hPageFile, UNICODE_STRING *PagingFileName){
PVOID v4;
UINT64 v5;
INT64 v7[2];
__int64 v8[4];
char v9;
int v10;
__int16 v11;
char v12;
PVOID Object;
LODWORD(Object) = 0;
v7[0] = 0i64;
LODWORD(v7[1]) = 0;
if( !ForceDumpDisabled )
{
IopReadDumpRegistry((UINT64 *)hPageFile, (UINT64)&Object);
if( CrashdmpImageEntry && CrashdmpDumpBlock && CrashdmpInitialized || !(_DWORD)Object )
return 1;
if( (CrashdmpImageEntry || (int)IopLoadCrashdumpDriver() >= 0)
&& (int)SecureDump_GetSecureDumpSettings((INT64)v7) >= 0 )
{
if( !LOBYTE(v7[0]) )
goto LABEL_9;
if( qword_140C50A08 )
{
v8[3] = *(INT64 *)((char *)v7 + 4);
v9 = BYTE1(v7[0]);
v8[1] = (__int64)SecureDump_Get_SecureDumpHeader;
v8[2] = (__int64)SecureDump_Encrypt_DmpData;
v8[0] = 40i64;
v10 = 0;
v11 = 0;
v12 = 0;
if( (int)qword_140C50A08(v8) >= 0 )
{
LABEL_9:
*(UNICODE_STRING *)v7 = *PagingFileName;
if( (int)((__int64(__fastcall *)(PVOID, __int64 *, INT64 *))qword_140C509A8)(
hPageFile,
&CrashdmpDumpBlock,
v7) >= 0 )
{
CrashdmpInitialized = 1;
v4 = *(PVOID *)(CrashdmpDumpBlock + 1352);
if( !v4 )
{
if( !hPageFile )
return 1;
v4 = hPageFile;
}
Object = 0i64;
if( ObReferenceObjectByHandle(v4, 0, (POBJECT_TYPE)IoFileObjectType, 0, &Object, 0i64) >= 0 )
{
FsRtlIssueFileNotificationFsctl(
(_FILE_OBJECT *)Object,
v5,
(_GUID *)&FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE);
HalPutDmaAdapter((PADAPTER_OBJECT)Object);
}
return 1;
}
CrashdmpDumpBlock = 0i64;
}
}
}
}
return 0;
}Referenced by:
IoConfigureCrashDump
IoInitializeCrashDump
IopInitCrashDumpRegCallback