PiNotifyCiDriverBlocked

__int64 __fastcall PiNotifyCiDriverBlocked(_OWORD *a1, const VOID **a2){
  unsigned int v4; 
  VOID **PoolWithTag; 
  VOID **v6; 
  UINT64 v8; 
  unsigned int updated; 
  UINT64 v10; 
  UINT64 v11; 

  v4 = *(unsigned __int16 *)a2 + 18;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v4, 538996816i64);
  v6 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225495i64;
  *(_OWORD *)PoolWithTag = *a1;
  *((_WORD *)PoolWithTag + 8) = *(_WORD *)a2;
  memmove((char *)PoolWithTag + 18, a2[1], *(unsigned __int16 *)a2);
  v8 = 4096i64;
  if( v4 < 0x1000 )
    v8 = v4;
  LODWORD(v11) = 0;
  LODWORD(v10) = 0;
  updated = ZwUpdateWnfStateData(&WNF_CI_BLOCKED_DRIVER, v6, v8, 0i64, 0i64, v10, v11);
  ExFreePoolWithTag(v6, 0);
  return updated;
}

Referenced by: