PopEtProcessSnapshotCreate

NTSTATUS __stdcall PopEtProcessSnapshotCreate(INT64 a1, INT64 **a2){
  __int64 v2; 
  INT64 **v3; 
  _EPROCESS *v4; 
  VOID **PoolWithTag; 
  INT64 *v6; 
  unsigned __int64 v7; 
  unsigned int v8; 
  __int64 v9; 
  char *v10; 
  char *v11; 
  char v12; 
  unsigned __int64 v13; 
  unsigned int v14; 
  __int64 v15; 
  __int64 v16; 
  _QWORD *v17; 
  __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  NTSTATUS v21; 
  VOID *v23; 
  __int64 v24; 
  __int64 v25; 

  v2 = *(_QWORD *)(a1 + 16);
  v3 = a2;
  v4 = *(_EPROCESS **)(a1 + 8);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1F0ui64, 1413836624i64);
  v6 = (INT64 *)PoolWithTag;
  if( PoolWithTag )
  {
    memset(PoolWithTag, 0i64, 0x1F0u);
    v6[1] = (INT64)v4;
    PopEtAggregateKeyCopyFromProcess(v6 + 2, v4, v2 + 32);
    PopEtStringSet(v6 + 3, 0i64);
    v7 = v2 + 64;
    v8 = *(_DWORD *)(v2 + 68);
    v9 = 2 * (v8 >> 5);
    if( *(_DWORD *)(v2 + 64) < (unsigned int)v9 )
      goto LABEL_21;
    if( (unsigned int)v9 < 4 )
      v9 = 4i64;
    LODWORD(v10) = PopEtBucketsAllocate(8 * v9);
    v11 = v10;
    if( v10 )
    {
      if( (((_DWORD)v9 - 1) & (unsigned int)v9) != 0 )
      {
        v12 = -1;
        do
        {
          ++v12;
          LODWORD(v9) = (unsigned int)v9 >> 1;
        }
        while( (_DWORD)v9 );
        v9 = (unsigned int)(1 << v12);
      }
      if( (unsigned int)v9 > 0x4000000 )
        v9 = 0x4000000i64;
      v13 = (unsigned int)v9;
      if( v10 > &v10[8 * v9] )
        v13 = 0i64;
      if( v13 )
        memset64(v10, v7 | 1, v13);
      v14 = 0;
      v15 = -1i64 << (*(_BYTE *)(v2 + 68) & 0x1F);
      if( (*(_DWORD *)(v2 + 68) & 0xFFFFFFE0) != 0 )
      {
        do
        {
          v16 = *(_QWORD *)(v2 + 72);
          while( 1 )
          {
            v17 = *(_QWORD **)(v16 + 8i64 * v14);
            if( ((unsigned __int8)v17 & 1) != 0 )
              break;
            *(_QWORD *)(v16 + 8i64 * v14) = *v17;
            v24 = v15 & v17[1];
            v18 = (37
                 * (BYTE6(v24)
                  + 37
                  * (BYTE5(v24)
                   + 37
                   * (BYTE4(v24)
                    + 37 * (BYTE3(v24) + 37 * (BYTE2(v24) + 37 * (BYTE1(v24) + 37 * ((unsigned __int8)v24 + 11623883)))))))
                 + HIBYTE(v24)) & (unsigned int)(v9 - 1);
            *v17 = *(_QWORD *)&v10[8 * v18];
            *(_QWORD *)&v10[8 * v18] = v17;
          }
          ++v14;
        }
        while( v14 < *(_DWORD *)(v2 + 68) >> 5 );
        v3 = a2;
      }
      v23 = *(VOID **)(v2 + 72);
      v8 = (32 * v9) | *(_DWORD *)(v2 + 68) & 0x1F;
      *(_QWORD *)(v2 + 72) = v11;
      *(_DWORD *)(v2 + 68) = v8;
      if( v23 )
      {
        PopEtBucketsFree(v23);
        v8 = *(_DWORD *)(v2 + 68);
      }
      goto LABEL_21;
    }
    v8 = *(_DWORD *)(v2 + 68);
    if( v8 >= 0x20 )
    {
LABEL_21:
      *v3 = v6;
      v25 = v6[1] & (-1i64 << (v8 & 0x1F));
      v19 = *(_QWORD *)(v2 + 72);
      v20 = (37
           * (BYTE6(v25)
            + 37
            * (BYTE5(v25)
             + 37
             * (BYTE4(v25)
              + 37 * (BYTE3(v25) + 37 * (BYTE2(v25) + 37 * (BYTE1(v25) + 37 * ((unsigned __int8)v25 + 11623883)))))))
           + HIBYTE(v25)) & ((v8 >> 5) - 1);
      *v6 = *(_QWORD *)(v19 + 8 * v20);
      *(_QWORD *)(v19 + 8 * v20) = v6;
      ++*(_DWORD *)v7;
      return 0;
    }
  }
  ++*(_DWORD *)(v2 + 612);
  v21 = -1073741670;
  if( v6 )
  {
    PopEtAggregateKeyCleanup(v6 + 2);
    ExFreePoolWithTag(v6, 0x54456F50u);
  }
  return v21;
}

Referenced by: