SepProbeAndCaptureString_U

NTSTATUS __stdcall SepProbeAndCaptureString_U(
        _UNICODE_STRING *SourceString,
        _UNICODE_STRING **DestString,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  __int64 v9; 
  int v10; 
  const VOID *v11; 
  unsigned __int64 v12; 
  VOID **PoolWithTag; 
  NTSTATUS v15; 

  *DestString = 0i64;
  v15 = 0;
  v9 = 0x7FFFFFFF0000i64;
  if( (unsigned __int64)SourceString < 0x7FFFFFFF0000i64 )
    v9 = (__int64)SourceString;
  v10 = *(_DWORD *)v9;
  v11 = *(const VOID **)(v9 + 8);
  if( (unsigned __int16)*(_DWORD *)v9 )
  {
    if( ((unsigned __int8)v11 & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v12 = (unsigned __int64)v11 + (unsigned __int16)v10;
    if( v12 > 0x7FFFFFFF0000i64 || v12 < (unsigned __int64)v11 )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  if( (v10 & 1) != 0 || (unsigned __int16)v10 == 65534 )
    return -1073741811;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned __int16)v10 + 16i64, 1934976339i64);
  *DestString = (_UNICODE_STRING *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  *(_WORD *)PoolWithTag = v10;
  (*DestString)->MaximumLength = v10;
  (*DestString)->Buffer = &(*DestString)[1].Length;
  if( (_WORD)v10 )
    memmove((*DestString)->Buffer, v11, (unsigned __int16)v10);
  return v15;
}

Referenced by: