PopCreateDumpMdl
VOID __fastcall PopCreateDumpMdl(INT64 a1, _DWORD *a2, UINT64 a3, UINT64 a4){
__int64 v5;
UINT64 v6;
_QWORD *v7;
v5 = *((unsigned int *)KeGetCurrentPrcb() + 9);
if( a3 >= a4 )
PopInternalError(0xA147Fui64);
v6 = a4 - a3;
if( v6 >= *(unsigned int *)(a1 + 284) )
v6 = *(unsigned int *)(a1 + 284);
*(_QWORD *)a2 = 0i64;
*((_WORD *)a2 + 5) = 0;
*((_QWORD *)a2 + 4) = 0i64;
*((_WORD *)a2 + 4) = 8 * (v6 + 6);
v7 = a2 + 12;
for( *((_QWORD *)a2 + 5) = (unsigned int)((_DWORD)v6 << 12); v6; --v6 )
*v7++ = a3++;
MmMapMemoryDumpMdlEx(*(PVOID *)((v5 << 7) + *(_QWORD *)(a1 + 264) + 8), *(unsigned int *)(a1 + 284), (_MDL *)a2, 0i64);
if( (a2[10] & 0xFFF) != 0 )
{
PopInternalAddToDumpFile(a2, 0x30ui64, 0i64);
KeBugCheckEx(0xA0u, 0x106ui64, 0xAui64, (ULONG_PTR)a2, 0i64);
}
}Referenced by:
PopSaveHiberContext