ExGetPoolTagInfo

NTSTATUS __stdcall ExGetPoolTagInfo(PVOID SystemInformation, UINT64 SystemInformationLength, UINT64 *ReturnLength){
  unsigned int v4; 
  INT64 v6; 
  __int64 v7; 
  UINT64 v8; 
  VOID **PoolWithTag; 
  VOID **v10; 
  VOID **v11; 
  VOID **v12; 
  unsigned int v13; 
  unsigned int v14; 
  unsigned int v15; 
  int v17; 
  NTSTATUS v18; 
  VOID **v19; 
  char *v20; 
  __int64 v21[10]; 

  v4 = SystemInformationLength;
  v18 = 0;
  v20 = (char *)SystemInformation + 8;
  v17 = 8;
  *(_DWORD *)SystemInformation = 0;
  v6 = PoolTrackTableSize;
  v7 = PoolTrackTableExpansionSize;
  v8 = 56 * PoolTrackTableSize + 56 * PoolTrackTableExpansionSize;
  if( v8 < 56 * PoolTrackTableSize )
    return -1073741670;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v8, 1868983881i64);
  v10 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  v21[0] = (__int64)PoolWithTag;
  v21[1] = PoolTrackTableSize;
  v21[2] = (__int64)&PoolWithTag[7 * PoolTrackTableSize];
  v21[3] = v7;
  KeGenericCallDpc((__int64)ExpGetPoolTagInfoTarget, (__int64)v21);
  v11 = v10;
  v19 = v10;
  while( v11 < &v10[7 * v7] + 7 * v6 )
  {
    if( !*(_DWORD *)v11 )
      goto LABEL_6;
    ++*(_DWORD *)SystemInformation;
    v13 = v17 + 40;
    v17 = v13;
    if( v13 < 0x28 )
    {
      v18 = -1073741675;
      break;
    }
    if( v4 < v13 )
    {
      v18 = -1073741820;
LABEL_6:
      v12 = v19;
      goto LABEL_7;
    }
    *(_DWORD *)v20 = *(_DWORD *)v19;
    v12 = v19;
    *((_DWORD *)v20 + 1) = *((_DWORD *)v19 + 10);
    *((_DWORD *)v20 + 2) = *((_DWORD *)v19 + 12);
    *((_QWORD *)v20 + 2) = v19[4];
    *((_DWORD *)v20 + 6) = *((_DWORD *)v19 + 4);
    *((_DWORD *)v20 + 7) = *((_DWORD *)v19 + 6);
    *((_QWORD *)v20 + 4) = v19[1];
    v14 = *((_DWORD *)v20 + 2);
    if( *((_DWORD *)v20 + 1) < v14 )
      *((_DWORD *)v20 + 1) = v14;
    v15 = *((_DWORD *)v20 + 7);
    if( *((_DWORD *)v20 + 6) < v15 )
      *((_DWORD *)v20 + 6) = v15;
    v20 += 40;
LABEL_7:
    v11 = v12 + 7;
    v19 = v11;
  }
  ExFreePoolWithTag(v10, 0);
  if( ReturnLength )
    *(_DWORD *)ReturnLength = v17;
  return v18;
}

Referenced by: