EtwpFindDebugId

NTSTATUS __stdcall EtwpFindDebugId(VOID *ImageBase, UINT64 ImageSize, _CVDD **DebugId, UINT64 *DebugIdSize){
  char v4; 
  unsigned __int64 v5; 
  unsigned int v7; 
  unsigned __int64 v8; 
  unsigned int v9; 
  unsigned __int64 v11; 
  UINT64 v12; 
  _DWORD *v13; 
  VOID **PoolWithTag; 
  VOID **v15; 
  UINT64 Size; 
  unsigned int v17; 
  UINT64 v18; 
  UINT64 v19; 
  UINT64 v20; 
  __int128 v21; 
  INT64 v22; 
  int v23; 
  char v25; 
  _DWORD *v27; 

  v25 = (char)DebugId;
  v4 = (char)DebugId;
  v5 = ImageSize;
  v7 = 0;
  v18 = 0i64;
  v19 = 0i64;
  LODWORD(Size) = 0;
  v8 = (unsigned __int64)RtlImageDirectoryEntryToData(ImageBase, 1u, 6u, &Size);
  v20 = v8;
  if( !v8 || (unsigned int)Size < 0x1C )
    return -1073741811;
  v9 = (unsigned int)Size / 0x1C;
  v17 = 0;
  while( 1 )
  {
    if( v7 >= v9 )
      return -1073741275;
    if( v8 < (unsigned __int64)ImageBase )
      return -1073741811;
    Size = v8 + 28;
    if( v8 + 28 > (unsigned __int64)ImageBase + v5 )
      return -1073741811;
    if( v4 && !EtwpIsValidImageAddress(v8, 28i64, &v18) )
      return -1073739517;
    v21 = *(_OWORD *)v8;
    v22 = *(_QWORD *)(v8 + 16);
    v23 = *(_DWORD *)(v8 + 24);
    v11 = HIDWORD(v22);
    if( HIDWORD(v22) > v5 )
      return -1073741811;
    v12 = (unsigned int)v22;
    if( (unsigned int)v22 > v5 || v11 > v5 - (unsigned int)v22 )
      return -1073741811;
    if( HIDWORD(v21) == 2 )
      break;
LABEL_26:
    v8 = Size;
    v20 = Size;
    v17 = ++v7;
    v4 = v25;
  }
  v13 = (char *)ImageBase + v11;
  if( v25 && !EtwpIsValidImageAddress((INT64)ImageBase + v11, (unsigned int)v22, &v19) )
    return -1073739517;
  if( *v13 != 1396986706 )
  {
    v5 = ImageSize;
    goto LABEL_26;
  }
  if( (unsigned int)v12 < 0x1C )
    return -1073741701;
  if( *v27 >= (unsigned int)v12 )
  {
    v15 = (VOID **)DebugIdSize;
  }
  else
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v12, 1651995717i64);
    v15 = (VOID **)DebugIdSize;
    *DebugIdSize = (UINT64)PoolWithTag;
    if( !PoolWithTag )
      return -1073741801;
  }
  *v27 = v12;
  memmove(*v15, v13, v12);
  return 0;
}

Referenced by: