PopIdleWakeSystemImageCallback

NTSTATUS __stdcall PopIdleWakeSystemImageCallback(INT64 a1, UINT64 *a2){
  _DWORD *v2; 
  NTSTATUS v3; 
  unsigned int v4; 
  UINT64 *v5; 
  UINT64 v7; 
  UINT64 v8; 
  _DWORD *v9; 
  unsigned __int64 v10; 
  VOID **PoolWithTag; 

  v2 = (_DWORD *)a2[3];
  v3 = 0;
  v4 = 0;
  v5 = a2;
  do
  {
    v7 = *v5;
    if( !*v5 )
      break;
    v8 = *(_QWORD *)(a1 + 48);
    if( v7 >= v8 && v7 < v8 + *(unsigned int *)(a1 + 64) )
    {
      v9 = &v2[4 * (*v2)++];
      v10 = *(unsigned __int16 *)(a1 + 88) + 24i64;
      if( v10 > 0xFFFF )
        return -2147483643;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, *(unsigned __int16 *)(a1 + 88) + 24i64, 1734960208i64);
      *((_QWORD *)v9 + 2) = PoolWithTag;
      if( !PoolWithTag )
        return -1073741670;
      *((_WORD *)v9 + 4) = 0;
      *((_WORD *)v9 + 5) = v10;
      v3 = RtlUnicodeStringPrintf((_UNICODE_STRING *)(v9 + 2), (WCHAR *)L"%s+0x%08X");
    }
    ++v4;
    ++v5;
  }
  while( v4 < 3 );
  return v3;
}

Referenced by: