SepAllocateAndInitializeCachedHandleEntry

INT64 __fastcall SepAllocateAndInitializeCachedHandleEntry(INT64 *a1, CHAR **a2){
  int v3; 
  __int64 v5; 
  __int64 v6; 
  char *PoolWithTag; 
  UNICODE_STRING *v8; 
  CHAR *v9; 
  *a2 = 0i64;
  v3 = *(_DWORD *)a1;
  v5 = 72i64;
  if( v3 )
  {
    if( v3 == 1 )
      v5 = *((unsigned __int16 *)a1 + 5) + 72i64;
  }
  else
  {
    v5 = 4i64 * *(unsigned __int8 *)(a1[1] + 1) + 80;
  }
  v6 = (v5 + 3) & 0xFFFFFFFCi64;
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v6, 0x734C6553ui64);
  v9 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  *((_QWORD *)PoolWithTag + 8) = 0i64;
  *((_DWORD *)PoolWithTag + 14) = 0;
  *((_QWORD *)PoolWithTag + 3) = 1i64;
  *((_DWORD *)PoolWithTag + 8) = *(_DWORD *)a1;
  if( *(_DWORD *)a1 )
  {
    if( *(_DWORD *)a1 == 1 )
    {
      *((_WORD *)PoolWithTag + 20) = *((_WORD *)a1 + 4);
      *((_WORD *)PoolWithTag + 21) = *((_WORD *)a1 + 5);
      *((_QWORD *)PoolWithTag + 6) = PoolWithTag + 72;
      RtlCopyUnicodeString((UNICODE_STRING *)(PoolWithTag + 40), (UNICODE_STRING *)(a1 + 1), v8);
    }
  }
  else
  {
    *((_QWORD *)PoolWithTag + 5) = PoolWithTag + 72;
    RtlCopySid(v6 - 72, PoolWithTag + 72, (PSID)a1[1]);
  }
  *a2 = v9;
  return 0i64;
}

Referenced by: