DbgkpLkmdFireCallbacks
VOID __stdcall DbgkpLkmdFireCallbacks(_DUMP_FILE_DESCRIPTOR *DumpFile, UINT64 CallbackType, VOID *Object){
char v3;
int v5;
NTSTATUS ProcessSessionId;
_EX_CALLBACK *v8;
__int64 v9;
_EX_RUNDOWN_REF *v10;
_EX_CALLBACK v11;
int(__fastcall *Count)(VOID(__fastcall *)(_DUMP_FILE_DESCRIPTOR *, VOID *, UINT64), UINT8(__stdcall *)(VOID *, VOID *, UINT64), _DUMP_FILE_DESCRIPTOR *, unsigned __int64, VOID *);
v3 = 1;
v5 = CallbackType;
if( (CallbackType & 1) != 0 )
{
ProcessSessionId = PsGetProcessSessionIdEx((INT64)KeGetCurrentThread()->ApcState.Process);
if( ProcessSessionId != PsGetProcessSessionIdEx((INT64)Object) || ProcessSessionId == -1 )
v3 = 0;
}
v8 = &stru_140C53C70;
v9 = 8i64;
do
{
v10 = ExReferenceCallBackBlock((INT64 *)v8);
if( v10 )
{
v11 = v8[2];
if( (*(_DWORD *)&v11 & v5) != 0 && ((v11.RoutineBlock[0] & 4) == 0 || v3) )
{
Count = (int(__fastcall *)(VOID(__fastcall *)(_DUMP_FILE_DESCRIPTOR *, VOID *, UINT64), UINT8(__stdcall *)(VOID *, VOID *, UINT64), _DUMP_FILE_DESCRIPTOR *, unsigned __int64, VOID *))v10[1].Count;
(*((void(__fastcall **)(_DUMP_FILE_DESCRIPTOR *))DumpFile + 1289))(DumpFile + 2560);
if( Count(DbgkpLkmdSnapData, DbgkpLkmdIsMemoryBlockPresentFromCallback, DumpFile, v10[2].Count, Object) < 0 )
(*((void(__fastcall **)(_DUMP_FILE_DESCRIPTOR *))DumpFile + 1290))(DumpFile + 2560);
}
ExDereferenceCallBackBlock(v8, v10);
}
v8 += 4;
--v9;
}
while( v9 );
}Referenced by:
DbgkCaptureLiveDump