DbgkpLkmdFireCallbacks
VOID __fastcall DbgkpLkmdFireCallbacks(INT64 a1, INT64 a2, INT64 a3){
char v3;
int v5;
int ProcessSessionId;
INT64 *v8;
__int64 v9;
struct EX_RUNDOWN_REF *v10;
int v11;
int(__fastcall *Count)(__int64(__fastcall *)(__int64, __int64, __int64), UINT8(__stdcall *)(PVOID, PVOID, UINT64), INT64, unsigned __int64, INT64);
v3 = 1;
v5 = a2;
if( (a2 & 1) != 0 )
{
ProcessSessionId = PsGetProcessSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
if( ProcessSessionId != (unsigned int)PsGetProcessSessionIdEx(a3) || ProcessSessionId == -1 )
v3 = 0;
}
v8 = &stru_140C53C70;
v9 = 8i64;
do
{
v10 = ExReferenceCallBackBlock(v8);
if( v10 )
{
v11 = *((_DWORD *)v8 + 2);
if( (v11 & v5) != 0 && ((v11 & 4) == 0 || v3) )
{
Count = (int(__fastcall *)(__int64(__fastcall *)(__int64, __int64, __int64), UINT8(__stdcall *)(PVOID, PVOID, UINT64), INT64, unsigned __int64, INT64))v10[1].Count;
(*(void(__fastcall **)(INT64))(a1 + 10312))(a1 + 10240);
if( Count(DbgkpLkmdSnapData, DbgkpLkmdIsMemoryBlockPresentFromCallback, a1, v10[2].Count, a3) < 0 )
(*(void(__fastcall **)(INT64))(a1 + 10320))(a1 + 10240);
}
ExDereferenceCallBackBlock(v8, v10);
}
v8 += 2;
--v9;
}
while( v9 );
}Referenced by:
DbgkCaptureLiveDump