PopPluginQuerySocSubsystemMetadata

INT64 __fastcall PopPluginQuerySocSubsystemMetadata(INT64 a1, INT64 a2, INT64 a3){
  unsigned int v3; 
  UINT64 v5; 
  UINT64 v6; 
  UINT8 v7; 
  __int64 v8; 
  INT64 result; 
  WCHAR **v10; 
  _OWORD *PoolWithTag; 
  _OWORD *v12; 
  _OWORD **v13; 
  _OWORD *v14; 
  _OWORD *v15; 
  const _UNICODE_STRING *v16; 
  __int64 v17; 
  UNICODE_STRING **v18; 
  WCHAR **v19; 
  __int128 v20; 
  INT64 HashValue; 
  int v22; 
  unsigned int v23; 
  v22 = a2;
  HashValue = a1;
  v3 = *(_DWORD *)(a3 + 28);
  v5 = PopFxProcessorPlugin;
  LODWORD(HashValue) = 0;
  v6 = 16i64 * v3;
  v23 = v3;
  v7 = 0;
  v8 = v3;
  result = (INT64)ExAllocatePoolWithTag(PagedPool, v6, 0x4D584650ui64);
  v10 = (WCHAR **)result;
  if( result )
  {
    memset(result, 0i64);
    PoolWithTag = ExAllocatePoolWithTag(PagedPool, v6, 0x4D584650ui64);
    v12 = PoolWithTag;
    if( PoolWithTag )
    {
      memset((INT64)PoolWithTag, 0i64);
      v20 = *(_OWORD *)*(_QWORD *)(a3 + 16);
      if( v3 )
      {
        v13 = (_OWORD **)(a3 + 32);
        v14 = v12;
        do
        {
          *(_OWORD *)((char *)v14 + (char *)v10 - (char *)v12) = **v13;
          v15 = *v13++;
          *v14++ = v15[1];
          --v8;
        }
        while( v8 );
      }
      v7 = (*(__int64(__fastcall **)(__int64, INT64))(v5 + 96))(40i64, a3);
      if( !v7 )
        PopFxBugCheck(0x605ui64, 0x28ui64, PopFxProcessorPlugin, 0i64);
      v16 = *(const _UNICODE_STRING **)(a3 + 16);
      RtlHashUnicodeString(v16, 0, 0i64, (UINT64 *)&HashValue);
      if( *(_DWORD *)&v16->Length != (_DWORD)v20
        || v16->Buffer != (wchar_t *)*((_QWORD *)&v20 + 1)
        || (_DWORD)HashValue != v22 )
      {
        PopFxBugCheck(0x705ui64, v5, 0x28ui64, 0x534E616Dui64);
      }
      v17 = 0i64;
      if( v3 )
      {
        v18 = (UNICODE_STRING **)(a3 + 32);
        v19 = v10 + 1;
        do
        {
          if( !PopFxValidateReturnedUnicodeString(*v18, *v19, *((unsigned __int16 *)v19 - 3)) )
            PopFxBugCheck(0x706ui64, 0x28ui64, 0x4B657920ui64, *(_QWORD *)(a3 + 8 * v17 + 32) + 8i64);
          v7 = PopFxValidateReturnedUnicodeString(
                 *v18 + 1,
                 *(WCHAR **)((char *)v19 + (char *)v12 - (char *)v10),
                 *(unsigned __int16 *)((char *)v19 + (char *)v12 - (char *)v10 - 6));
          if( !v7 )
            PopFxBugCheck(0x706ui64, 0x28ui64, 0x56616C75ui64, *(_QWORD *)(a3 + 8 * v17 + 32) + 24i64);
          v17 = (unsigned int)(v17 + 1);
          ++v18;
          v19 += 2;
        }
        while( (unsigned int)v17 < v23 );
      }
    }
    ExFreePoolWithTag(v10, 0x4D584650u);
    if( v12 )
      ExFreePoolWithTag(v12, 0x4D584650u);
  }
  LOBYTE(result) = v7;
  return result;
}

Referenced by: