IopLiveDumpBufferDumpData
void __fastcall IopLiveDumpBufferDumpData(__int64 *a1, unsigned int *a2){
__int64 v2;
unsigned int v3;
INT64 v4;
INT64 v5;
__int64 v6;
__int64 v7;
unsigned int v8;
unsigned int v9;
unsigned int v10;
unsigned int v11;
_QWORD *v12;
__int64 v13;
__int64 v14;
__int64 v15;
_DWORD *v16;
__int64 v17;
unsigned __int64 v18;
_DWORD *v19;
__int64 v20;
INT64 v21;
INT64 v22;
INT64 a5;
INT64 a6;
_DWORD *v25;
UINT64 *a1a;
v2 = *a1;
a6 = 0i64;
LODWORD(a5) = 0;
v3 = *a2;
v4 = v2 + 680;
v21 = v2 + 680;
if( *a2 < *(_DWORD *)(v2 + 784) && v3 < *(_DWORD *)(v2 + 1008) )
{
v5 = *(_QWORD *)(*(_QWORD *)(v2 + 1016) + 8i64 * v3);
v6 = *(_QWORD *)(v2 + 792) + 16i64 * v3;
v22 = v5;
a1a = (UINT64 *)(v2 + 544);
v7 = *(_QWORD *)(v6 + 8) + 48i64;
v20 = v7;
while( 1 )
{
v8 = BufferChunkSizeInPages;
KxAcquireSpinLock((UINT64 *)(v4 + 32));
IopLiveDumpGetCapturePagesNoLock(a1a, v4, v5, v8, (INT64)&a5, (INT64)&a6);
KxReleaseSpinLock((UINT64 *)(v4 + 32));
v9 = a5;
if( !(_DWORD)a5 )
break;
v10 = 0;
v11 = 0;
v25 = *(_DWORD **)(*(_QWORD *)(v4 + 72) + 8 * a6);
if( (_DWORD)a5 )
{
v12 = (_QWORD *)v5;
do
{
v13 = v10++;
*(_QWORD *)(v7 + 8 * v13) = *v12;
if( v10 == 16 || v10 && v11 == v9 - 1 )
{
v14 = *(_QWORD *)(v6 + 8);
*(_DWORD *)(v14 + 40) = v10 << 12;
*(_QWORD *)v14 = 0i64;
*(_WORD *)(v14 + 10) = 0;
*(_QWORD *)(v14 + 32) = 0i64;
*(_DWORD *)(v14 + 44) = 0;
*(_WORD *)(v14 + 8) = 8 * (((unsigned __int64)(v10 << 12) >> 12) + 6);
v15 = v10 << 12;
MmMapMemoryDumpMdlEx(*(PVOID *)v6, v10, *(_MDL **)(v6 + 8), 0i64);
v16 = *(_DWORD **)(*(_QWORD *)(v6 + 8) + 24i64);
v17 = (__int64)v25;
v18 = (unsigned __int64)(unsigned int)v15 >> 2;
v19 = v25;
while( v18 )
{
*v19++ = *v16++;
--v18;
}
v7 = v20;
v25 = (_DWORD *)(v15 + v17);
v10 = 0;
}
++v11;
++v12;
}
while( v11 < v9 );
v4 = v21;
v5 = v22;
}
}
}
}Referenced by:
IopLiveDumpProcessCorralStateChange