IopInitializeOfflineCrashDump

VOID __stdcall IopInitializeOfflineCrashDump(_LOADER_PARAMETER_EXTENSION *LdrBlckExtension){
  int v1; 
  NTSTATUS v2; 
  char v3; 
  _BYTE *v4; 
  INT64 v5; 
  UINT64 Create; 
  char v7; 
  char Value[7]; 
  HANDLE Handle; 
  PVOID P; 
  UINT64 ValueLength; 
  UNICODE_STRING KeyName; 
  GUID VendorGuid; 
  P = 0i64;
  v1 = 0;
  VendorGuid.Data1 = 2012912317;
  Handle = 0i64;
  dword_140C50940 = 0;
  *(_DWORD *)&VendorGuid.Data2 = 1295123289;
  *(_DWORD *)VendorGuid.Data4 = -198680387;
  *(_DWORD *)&VendorGuid.Data4[4] = 1266192359;
  *(_QWORD *)&KeyName.Length = 8388734i64;
  KeyName.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CrashControl";
  Value[0] = 0;
  LODWORD(ValueLength) = 1;
  v7 = 0;
  if( LdrBlckExtension )
  {
    if( (unsigned int)(*((_DWORD *)LdrBlckExtension + 694) - 1) <= 1 )
    {
      PoOffCrashConfigTable = *(_OWORD *)((char *)LdrBlckExtension + 2776);
      xmmword_140C24E30 = *(_OWORD *)((char *)LdrBlckExtension + 2792);
      v2 = IopOpenRegistryKey(&Handle, 0i64, &KeyName, 0x20019ui64, 0);
      if( v2 >= 0 )
      {
        if( IopGetRegistryValue(Handle, (PWCHAR)L"EnableOfflineDumps", 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) < 0 )
          goto LABEL_14;
        if( *((_DWORD *)P + 3) )
          v1 = *(_DWORD *)((char *)P + *((unsigned int *)P + 2));
        ExFreePoolWithTag(P, 0);
        if( v1 == 1 )
        {
          OfflineDumpEnabled = 1;
          v7 = 1;
        }
        else
        {
LABEL_14:
          OfflineDumpEnabled = 0;
          if( (unsigned int)PoOffCrashConfigTable >= 2 )
          {
            v3 = v7;
            if( (BYTE8(PoOffCrashConfigTable) & 4) != 0 )
              v3 = 4;
            v7 = v3;
          }
        }
        if( (int)IoGetEnvironmentVariableEx(
                    (WCHAR *)L"OfflineMemoryDumpUseCapability",
                    &VendorGuid,
                    Value,
                    &ValueLength,
                    0i64) < 0
          || Value[0] != v7 )
        {
          LODWORD(Create) = 7;
          IoSetEnvironmentVariableEx((WCHAR *)L"OfflineMemoryDumpUseCapability", &VendorGuid, &v7, 1ui64, Create);
        }
        if( OfflineDumpEnabled )
        {
          IopCachePreviousBootData(&Handle);
          IopInitializeInMemoryDumpData();
          IopConstructInMemoryDumpHeader(v5, v4);
          if( IopGetRegistryValue(Handle, (PWCHAR)L"AttemptOffline", 0i64, (KEY_VALUE_FULL_INFORMATION **)&P) >= 0 )
          {
            if( *((_DWORD *)P + 3) )
              DumpPolicyAttemptOffline = *(_DWORD *)((char *)P + *((unsigned int *)P + 2));
            ExFreePoolWithTag(P, 0);
          }
        }
      }
      else
      {
        dword_140C50940 = v2;
      }
    }
    else
    {
      dword_140C50940 = -1073741736;
    }
    if( Handle )
      ObCloseHandle(Handle, 0);
  }
  else
  {
    dword_140C50940 = -1073741275;
  }
}

Referenced by: