IopLiveDumpTraceBufferEstimation
NTSTATUS __stdcall IopLiveDumpTraceBufferEstimation(){
NTSTATUS result;
_QWORD *v1;
UINT64 UserDataCount;
__int64 v3;
__int64 v4;
__int64 v5;
__int64 v6;
__int64 v7;
EVENT_DATA_DESCRIPTOR UserData;
__int64 *v9;
__int64 v10;
__int64 *v11;
__int64 v12;
__int64 *v13;
__int64 v14;
__int64 *v15;
__int64 v16;
_QWORD *v17;
__int64 v18;
_QWORD *v19;
__int64 v20;
_QWORD *v21;
__int64 v22;
_QWORD *v23;
__int64 v24;
_QWORD *v25;
__int64 v26;
_QWORD *v27;
__int64 v28;
LOBYTE(result) = IopLiveDumpIsTracingEnabled();
if( (_BYTE)result )
{
v3 = v1[13] << 12;
v4 = v1[12] << 12;
v5 = v1[15] << 12;
v7 = v1[16] << 12;
v6 = v1[17] << 12;
UserData.Ptr = (unsigned __int64)&v3;
v9 = &v4;
v11 = &v5;
v13 = &v6;
v15 = &v7;
v17 = v1 + 54;
v19 = v1 + 55;
v21 = v1 + 56;
v23 = v1 + 58;
v25 = v1 + 59;
v27 = v1 + 36;
LODWORD(UserDataCount) = 11;
*(_QWORD *)&UserData.Size = 8i64;
v10 = 8i64;
v12 = 8i64;
v14 = 8i64;
v16 = 8i64;
v18 = 8i64;
v20 = 8i64;
v22 = 8i64;
v24 = 8i64;
v26 = 8i64;
v28 = 8i64;
return EtwWriteEx(
IopLiveDumpEtwRegHandle,
(EVENT_DESCRIPTOR *)&LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ESTIMATION,
0i64,
0i64,
0i64,
0i64,
UserDataCount,
&UserData);
}
return result;
}Referenced by:
IopLiveDumpEstimateMemoryPages