VfSuspectExcludedDriversAllocateEntry

VOID **__fastcall VfSuspectExcludedDriversAllocateEntry(unsigned __int16 *a1, unsigned int a2){
  VOID **PoolWithTag; 
  VOID **v4; 
  size_t v5; 
  const VOID *v6; 

  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, a1[1] + 32i64, a2);
  v4 = PoolWithTag;
  if( PoolWithTag )
  {
    v5 = *a1;
    *((_WORD *)PoolWithTag + 9) = a1[1];
    v6 = (const VOID *)*((_QWORD *)a1 + 1);
    PoolWithTag[3] = PoolWithTag + 4;
    *((_WORD *)PoolWithTag + 8) = v5;
    memmove(PoolWithTag + 4, v6, v5);
  }
  return v4;
}

Referenced by: