SepAllocateAndInitializeCachedHandleEntry

NTSTATUS __stdcall SepAllocateAndInitializeCachedHandleEntry(INT64 *a1, CHAR **a2){
  int v3; 
  __int64 v5; 
  __int64 v6; 
  VOID **PoolWithTag; 
  CHAR *v8; 

  *a2 = 0i64;
  v3 = *(_DWORD *)a1;
  v5 = 72i64;
  if( v3 )
  {
    if( v3 == 1 )
      v5 = *((unsigned __int16 *)a1 + 5) + 72i64;
  }
  else
  {
    v5 = 4i64 * *(unsigned __int8 *)(a1[1] + 1) + 80;
  }
  v6 = (v5 + 3) & 0xFFFFFFFCi64;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v6, 1934386515i64);
  v8 = (CHAR *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  PoolWithTag[8] = 0i64;
  *((_DWORD *)PoolWithTag + 14) = 0;
  PoolWithTag[3] = (VOID *)1;
  *((_DWORD *)PoolWithTag + 8) = *(_DWORD *)a1;
  if( *(_DWORD *)a1 )
  {
    if( *(_DWORD *)a1 == 1 )
    {
      *((_WORD *)PoolWithTag + 20) = *((_WORD *)a1 + 4);
      *((_WORD *)PoolWithTag + 21) = *((_WORD *)a1 + 5);
      PoolWithTag[6] = PoolWithTag + 9;
      RtlCopyUnicodeString((PUNICODE_STRING)(PoolWithTag + 5), (PCUNICODE_STRING)(a1 + 1));
    }
  }
  else
  {
    PoolWithTag[5] = PoolWithTag + 9;
    RtlCopySid((unsigned int)(v6 - 72), PoolWithTag + 9, (VOID *)a1[1]);
  }
  *a2 = v8;
  return 0;
}

Referenced by: