IopLiveDumpWriteDumpFile

INT64 __fastcall IopLiveDumpWriteDumpFile(INT64 a1){
  INT64 v1; 
  __int64 v2; 
  void *v3; 
  VOID *v5; 
  union _LARGE_INTEGER v6; 
  unsigned __int64 v7; 
  _ETHREAD *CurrentThread; 
  int SecureDumpHeader; 
  UINT64 v10; 
  MDL *v11; 
  UINT64 v12; 
  int v13; 
  UINT64 v14; 
  __int128 v15; 
  int v16; 
  __int128 v17; 
  __int64 v18; 
  union _LARGE_INTEGER v19; 
  UINT64 v20; 
  VOID *PoolWithTag; 
  UINT64 v22; 
  union _LARGE_INTEGER ByteOffset; 
  _ETHREAD *v25; 
  __int64 v26; 
  __int128 v27; 
  __int128 v28; 
  __int64 v29; 
  __int128 v30; 
  __int128 v31; 
  __int64 v32; 
  v1 = *(_QWORD *)(a1 + 560);
  v2 = a1 + 680;
  v3 = *(void **)(a1 + 64);
  v26 = 0i64;
  v5 = 0i64;
  v27 = 0i64;
  v29 = 0i64;
  v28 = 0i64;
  v32 = 0i64;
  v30 = 0i64;
  v31 = 0i64;
  if( *(_BYTE *)(a1 + 880) )
    v6.QuadPart = *(_QWORD *)(v1 + 8224) + *(unsigned int *)(a1 + 888);
  else
    v6 = *(union _LARGE_INTEGER *)(v1 + 8224);
  ByteOffset = v6;
  v7 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v25 = CurrentThread;
  if( !*(_QWORD *)(a1 + 736) )
  {
LABEL_14:
    v12 = RtlNumberOfSetBitsEx((_RTL_BITMAP_EX *)(a1 + 544));
    v13 = *(_DWORD *)(a1 + 984);
    v14 = v12;
    if( v13 )
    {
      v15 = *(_OWORD *)(a1 + 960);
      *(_QWORD *)&v28 = *(_QWORD *)(a1 + 976);
      v29 = *(_QWORD *)(a1 + 56);
      *(_QWORD *)(a1 + 56) = &v27;
      v27 = v15;
      DWORD2(v28) = v13;
    }
    v16 = *(_DWORD *)(a1 + 936);
    if( v16 )
    {
      v17 = *(_OWORD *)(a1 + 912);
      *(_QWORD *)&v31 = *(_QWORD *)(a1 + 928);
      v32 = *(_QWORD *)(a1 + 56);
      *(_QWORD *)(a1 + 56) = &v30;
      v30 = v17;
      DWORD2(v31) = v16;
    }
    SecureDumpHeader = IopLiveDumpWriteSecondaryData(v3, a1 + 48, &ByteOffset, &v26);
    if( SecureDumpHeader < 0 )
      goto LABEL_29;
    v18 = *(unsigned int *)(a1 + 888);
    v19 = ByteOffset;
    *(_DWORD *)(v1 + 4176) |= 0x10u;
    *(_QWORD *)(v1 + 4000) = v19.QuadPart - v18;
    *(_QWORD *)(v1 + 8232) = v14;
    *(_DWORD *)(v1 + 0x2000) = 1347241043;
    *(_DWORD *)(v1 + 8196) = 1347245380;
    if( *(_BYTE *)(a1 + 880) )
    {
      v20 = *(unsigned int *)(a1 + 888);
      ByteOffset.QuadPart = v20;
      PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, v20, 0x706D644Cui64);
      v5 = PoolWithTag;
      if( !PoolWithTag )
      {
        SecureDumpHeader = -1073741670;
        goto LABEL_29;
      }
      SecureDumpHeader = SecureDump_Get_SecureDumpHeader(v1, (INT64)PoolWithTag, *(unsigned int *)(a1 + 888));
      if( SecureDumpHeader < 0 )
        goto LABEL_27;
    }
    else
    {
      ByteOffset.QuadPart = 0i64;
    }
    SecureDumpHeader = IopLiveDumpWriteBuffer(v3, (VOID *)v1, *(unsigned int *)(v1 + 8224), &ByteOffset);
    if( *(_BYTE *)(a1 + 880) )
    {
      v22 = *(unsigned int *)(a1 + 888);
      ByteOffset.QuadPart = 0i64;
      SecureDumpHeader = IopLiveDumpWriteBuffer(v3, v5, v22, &ByteOffset);
    }
LABEL_27:
    if( v5 )
      ExFreePoolWithTag(v5, 0);
    goto LABEL_29;
  }
  while( 1 )
  {
    SecureDumpHeader = IopLiveDumpCheckTermination(a1, (INT64)CurrentThread);
    if( SecureDumpHeader < 0 )
      break;
    v10 = v7 >= *(_QWORD *)(v2 + 56) - 1i64 ? (unsigned int)(*(_DWORD *)(v2 + 40) << 12) : (unsigned int)BufferChunkSizeInBytes;
    SecureDumpHeader = IopLiveDumpWriteBuffer(v3, *(VOID **)(*(_QWORD *)(v2 + 72) + 8 * v7), v10, &ByteOffset);
    if( SecureDumpHeader < 0 )
      break;
    v11 = *(MDL **)(*(_QWORD *)(v2 + 80) + 8 * v7);
    if( v11 )
    {
      MmFreePagesFromMdl(v11);
      ExFreePoolWithTag(*(PVOID *)(*(_QWORD *)(v2 + 80) + 8 * v7), 0);
      *(_QWORD *)(*(_QWORD *)(v2 + 80) + 8 * v7) = 0i64;
    }
    else
    {
      MmFreeIndependentPages(*(PVOID *)(*(_QWORD *)(v2 + 72) + 8 * v7), (unsigned int)BufferChunkSizeInBytes);
    }
    *(_QWORD *)(*(_QWORD *)(v2 + 72) + 8 * v7++) = 0i64;
    CurrentThread = v25;
    if( v7 >= *(_QWORD *)(v2 + 56) )
      goto LABEL_14;
  }
LABEL_29:
  IopLiveDumpFreeDumpBuffers(v2);
  return(unsigned int)SecureDumpHeader;
}

Referenced by: