MmAddPrivateDataToCrashDump
__int64 __fastcall MmAddPrivateDataToCrashDump(__int64 (__fastcall **a1)(_QWORD, __int64, __int64), char a2){
unsigned int v2;
int v5;
_KPRCB **v6;
__int64 v7;
int v8;
int v9;
int v10;
__int64 *v11;
int v12;
int v13;
v2 = 0;
if( (a2 & 1) != 0 )
{
v5 = MmAddRangeToCrashDump(a1, MmPfnDatabase, 0x30000000000i64);
if( v5 < 0 )
v2 = v5;
}
if( (a2 & 2) != 0 && (_DWORD)KeNumberProcessors_0 )
{
v6 = &KiProcessorBlock;
v7 = (unsigned int)KeNumberProcessors_0;
do
{
v8 = (*a1)(a1, *(_QWORD *)(*(_QWORD *)(*((_QWORD *)*v6++ + 1) + 184i64) + 40i64) >> 12, 1i64);
if( v8 < 0 )
v2 = v8;
--v7;
}
while( v7 );
}
if( (a2 & 4) != 0 )
{
v9 = MmAddRangeToCrashDump(a1, PsNtosImageBase, PsNtosImageEnd - PsNtosImageBase);
if( v9 < 0 )
v2 = v9;
}
if( (a2 & 8) != 0 )
{
v10 = MmAddRangeToCrashDump(a1, (unsigned __int64)PsHalImageBase, PsHalImageEnd - (_QWORD)PsHalImageBase);
if( v10 < 0 )
v2 = v10;
}
if( (a2 & 0x10) != 0 )
{
v11 = (__int64 *)qword_140C4EC40;
while( v11 != &qword_140C4EC40 )
{
v12 = MmAddRangeToCrashDump(a1, (unsigned __int64)(v11 - 16), 20480i64);
v11 = (__int64 *)*v11;
if( v12 < 0 )
v2 = v12;
}
}
if( (a2 & 0x20) != 0 )
{
v13 = MiAddPartitionDataToCrashDump(a1);
if( v13 < 0 )
return(unsigned int)v13;
}
return v2;
}Referenced by:
IopAddLiveDumpPagesToPartialKernelDump
IopLiveDumpMarkImportantDumpData
IopLiveDumpMarkRequiredDumpData