PopPluginQuerySocSubsystemMetadata

NTSTATUS __fastcall PopPluginQuerySocSubsystemMetadata(
        POP_FX_PLUGIN *Plugin,
        UINT64 SubsystemNameHash,
        PEP_QUERY_SOC_SUBSYSTEM_METADATA *Query){
  unsigned int v3; 
  __int64 v5; 
  __int64 v6; 
  UINT8 v7; 
  __int64 v8; 
  VOID **PoolWithTag; 
  VOID **v10; 
  VOID **v11; 
  VOID **v12; 
  PEP_QUERY_SOC_SUBSYSTEM_METADATA *v13; 
  VOID **v14; 
  _OWORD *v15; 
  const _UNICODE_STRING *v16; 
  __int64 v17; 
  _UNICODE_STRING **v18; 
  WCHAR **v19; 
  __int128 v21; 
  UINT64 HashValue; 
  int v23; 
  unsigned int v24; 

  v23 = SubsystemNameHash;
  HashValue = (UINT64)Plugin;
  v3 = Query[7];
  v5 = *(_QWORD *)&PopFxProcessorPlugin;
  LODWORD(HashValue) = 0;
  v6 = 16i64 * v3;
  v24 = v3;
  v7 = 0;
  v8 = v3;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v6, 1297630800i64);
  v10 = PoolWithTag;
  if( PoolWithTag )
  {
    memset(PoolWithTag, 0i64, v6);
    v11 = ExAllocatePoolWithTag(1ui64, v6, 1297630800i64);
    v12 = v11;
    if( v11 )
    {
      memset(v11, 0i64, v6);
      v21 = *(_OWORD *)*((_QWORD *)Query + 2);
      if( v3 )
      {
        v13 = Query + 8;
        v14 = v12;
        do
        {
          *(_OWORD *)((char *)v14 + (char *)v10 - (char *)v12) = *(_OWORD *)*(_QWORD *)v13;
          v15 = *(_OWORD **)v13;
          v13 += 2;
          *(_OWORD *)v14 = v15[1];
          v14 += 2;
          --v8;
        }
        while( v8 );
      }
      v7 = (*(__int64(__fastcall **)(__int64, PEP_QUERY_SOC_SUBSYSTEM_METADATA *))(v5 + 96))(40i64, Query);
      if( !v7 )
        PopFxBugCheck(0x605u, 0x28u, PopFxProcessorPlugin, 0);
      v16 = (const _UNICODE_STRING *)*((_QWORD *)Query + 2);
      RtlHashUnicodeString(v16, 0, 0i64, &HashValue);
      if( *(_DWORD *)&v16->Length != (_DWORD)v21
        || v16->Buffer != (wchar_t *)*((_QWORD *)&v21 + 1)
        || (_DWORD)HashValue != v23 )
      {
        PopFxBugCheck(0x705u, v5, 0x28u, 0x534E616Du);
      }
      v17 = 0i64;
      if( v3 )
      {
        v18 = (_UNICODE_STRING **)(Query + 8);
        v19 = (WCHAR **)(v10 + 1);
        do
        {
          if( !PopFxValidateReturnedUnicodeString(*v18, *v19, *((unsigned __int16 *)v19 - 3)) )
            PopFxBugCheck(0x706u, 0x28u, 0x4B657920u, *(_QWORD *)&Query[2 * v17 + 8] + 8);
          v7 = PopFxValidateReturnedUnicodeString(
                 *v18 + 1,
                 *(WCHAR **)((char *)v19 + (char *)v12 - (char *)v10),
                 *(unsigned __int16 *)((char *)v19 + (char *)v12 - (char *)v10 - 6));
          if( !v7 )
            PopFxBugCheck(0x706u, 0x28u, 0x56616C75u, *(_QWORD *)&Query[2 * v17 + 8] + 24);
          v17 = (unsigned int)(v17 + 1);
          ++v18;
          v19 += 2;
        }
        while( (unsigned int)v17 < v24 );
      }
    }
    LODWORD(PoolWithTag) = (unsigned int)ExFreePoolWithTag(v10, 0x4D584650u);
    if( v12 )
      LODWORD(PoolWithTag) = (unsigned int)ExFreePoolWithTag(v12, 0x4D584650u);
  }
  LOBYTE(PoolWithTag) = v7;
  return(int)PoolWithTag;
}

Referenced by: