DbgkCaptureLiveDump

INT64 __fastcall DbgkCaptureLiveDump(INT64 a1, INT64 a2, UINT64 a3, INT64 a4){
  unsigned int v4; 
  REGHANDLE v7; 
  struct _DMA_ADAPTER *v8; 
  void *v9; 
  _DWORD *PoolWithTag; 
  UINT64 v11; 
  int v12; 
  __int64 v13; 
  int v14; 
  unsigned int i; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  void *v19; 
  NTSTATUS v20; 
  UINT64 v21; 
  int v22; 
  char v23; 
  void *v24; 
  int v25; 
  UINT64 v26; 
  KPROCESSOR_MODE AccessMode; 
  char v29; 
  ULONGLONG RegHandle; 
  PVOID Object; 
  _QWORD *v32; 
  __int128 v33; 
  INT64 v34; 
  INT64 result[1280]; 
  __int128 v36[2]; 
  PVOID P[2]; 
  __int64(__fastcall *v38[6])(__int64, int, __int64, __int64, __int64, __int64); 
  INT64 v39[2]; 
  v4 = a3;
  v34 = a4;
  v7 = 0i64;
  AccessMode = *((_BYTE *)KeGetCurrentThread() + 562);
  v8 = 0i64;
  v9 = 0i64;
  memset((INT64)result, 0i64);
  PoolWithTag = 0i64;
  v32 = 0i64;
  *(_OWORD *)v39 = 0i64;
  RegHandle = 0i64;
  v33 = 0i64;
  if( !*(_DWORD *)(a1 + 44) || v4 < 0x40000 || (*(_DWORD *)a1 & 0xFFFFFFFE) != 0 )
    return 3221225485i64;
  if( DbgkpLkmdSqmIsOptedIn() )
  {
    EtwRegister(&stru_1400100F8, 0i64, 0i64, &RegHandle);
    v7 = RegHandle;
    if( RegHandle )
      DbgkpLkmdSqmIncrementDword(RegHandle, 0xCDCui64, v11);
  }
  memset(v36, 0, sizeof(v36));
  *(_OWORD *)P = 0i64;
  v12 = DbgkpTriageDumpInitialize((__int64)v36, a2, v4, v38);
  v13 = 0i64;
  v14 = v12;
  if( v12 >= 0 )
  {
    v14 = v38[0](
            (__int64)v36,
            *(_DWORD *)(a1 + 4),
            *(_QWORD *)(a1 + 8),
            *(_QWORD *)(a1 + 16),
            *(_QWORD *)(a1 + 24),
            *(_QWORD *)(a1 + 32));
    if( v14 >= 0 )
    {
      DbgkpLkmdSnapGlobals((__int64)result);
      LODWORD(RegHandle) = 4 * *(_DWORD *)(a1 + 44) + 4;
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)RegHandle, 0x704E534Bui64);
      if( PoolWithTag )
      {
        for( i = 0; i < *(_DWORD *)(a1 + 44); PoolWithTag[v16] = -1073741823 )
          v16 = i++;
        PoolWithTag[i] = 1112752980;
      }
      v14 = -1073741790;
      v29 = 1;
      if( *(_DWORD *)(a1 + 44) )
      {
        while( 1 )
        {
          v17 = *(_QWORD *)(a1 + 48);
          v18 = (unsigned int)(v13 + *(_DWORD *)(a1 + 40));
          v39[1] = 0i64;
          v39[0] = 3221225473i64;
          v19 = *(void **)(v17 + 8 * v18);
          Object = 0i64;
          v20 = ObReferenceObjectByHandle(v19, 0x1FFFFFu, (POBJECT_TYPE)PsThreadType, AccessMode, &Object, 0i64);
          v8 = (struct _DMA_ADAPTER *)Object;
          v22 = v20;
          v23 = v29;
          if( v22 != -1073741790 )
            v23 = 0;
          v29 = v23;
          if( v22 >= 0 )
          {
            if( !v9 )
            {
              IoThreadToProcess((_ETHREAD *)Object);
              v9 = v24;
              if( v24 )
              {
                ObfReferenceObjectWithTag(v24, 0x4C676244u);
                DbgkpLkmdSnapDataEx((INT64)result);
              }
            }
            v25 = DbgkpLkmdSnapThread((INT64)result, a1, (INT64)v8, (INT64)v39);
            if( !v25 )
              v25 = v39[0];
            if( PoolWithTag )
              PoolWithTag[v13] = v25;
            DbgkpLkmdFireCallbacks((INT64)result, 2i64, (INT64)v8);
            if( v7 )
              DbgkpLkmdSqmStatus(v7, (int *)v39, v26);
            HalPutDmaAdapter(v8);
            v8 = 0i64;
            if( LODWORD(v39[0]) == -1073741670 )
            {
LABEL_32:
              if( !v29 )
              {
                if( v9 )
                  DbgkpLkmdFireCallbacks((INT64)result, 1i64, (INT64)v9);
                LODWORD(v33) = *(_DWORD *)(a1 + 44);
                *((_QWORD *)&v33 + 1) = PoolWithTag;
                DbgkpLkmdSnapData((__int64)result, (__int64)&v33, 16i64);
                if( PoolWithTag )
                  DbgkpLkmdSnapData((__int64)result, (__int64)PoolWithTag, (unsigned int)RegHandle);
                if( (int)DbgkpLkmdSnapDataEx((INT64)result) >= 0 )
                  *v32 = &v33;
                v14 = ((__int64(__fastcall *)(__int128 *, INT64))v38[5])(v36, v34);
              }
              break;
            }
          }
          else
          {
            if( PoolWithTag )
              PoolWithTag[v13] = v22;
            if( v7 )
            {
              LODWORD(v39[0]) = v22;
              DbgkpLkmdSqmStatus(v7, (int *)v39, v21);
            }
          }
          v13 = (unsigned int)(v13 + 1);
          if( (unsigned int)v13 >= *(_DWORD *)(a1 + 44) )
            goto LABEL_32;
        }
      }
      if( v9 )
        ObfDereferenceObjectWithTag(v9, 0x4C676244ui64);
      if( v8 )
        HalPutDmaAdapter(v8);
    }
  }
  if( P[0] )
    ExFreePoolWithTag(P[0], 0x4D574454u);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x704E534Bu);
  if( v7 )
    EtwUnregister(v7);
  return(unsigned int)v14;
}

Referenced by: