RtlCreateRvaList

NTSTATUS __stdcall RtlCreateRvaList(INT64 a1, INT64 a2, INT64 a3, INT64 a4, VOID *Src, size_t Size, INT64 a7){
  __int64 v7; 
  __int64 *v9; 
  NTSTATUS v10; 
  unsigned __int64 v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  VOID **PoolWithTag; 
  size_t v16; 
  VOID **v17; 
  __int64 v18; 
  __int64 v19; 
  VOID *v20; 
  char *v21; 
  __int64 v23; 
  unsigned int v24; 
  int v25; 

  v25 = HIDWORD(a3);
  v7 = (unsigned int)a4;
  v24 = 0;
  v23 = 0i64;
  v9 = 0i64;
  v10 = RtlpCompressRvaList(0i64, a1, a3, a4, 0i64, (__int64)&v23, (__int64)&v24);
  if( v10 >= 0 )
  {
    v11 = v24;
    if( (unsigned int)v7 <= 1 )
      v12 = 0i64;
    else
      v12 = (((unsigned __int64)((unsigned int)v7 * v24) + 63) >> 3) & 0x1FFFFFFFFFFFFFF8i64;
    v13 = v23;
    v14 = (v23 + 7) & 0xFFFFFFFFFFFFFFF8ui64;
    *(_QWORD *)&Size = v12 + 4 * v7 + v14;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, *(_QWORD *)&Size + 64i64, 1281455698i64);
    v9 = (__int64 *)PoolWithTag;
    if( PoolWithTag )
    {
      v16 = Size;
      PoolWithTag[3] = (VOID *)v13;
      v17 = PoolWithTag + 8;
      *PoolWithTag = (VOID *)v11;
      *((_DWORD *)PoolWithTag + 2) = v7;
      PoolWithTag[2] = PoolWithTag + 8;
      memset(PoolWithTag + 8, 0i64, v16);
      v20 = Src;
      v21 = (char *)v17 + v14;
      if( Src )
      {
        v9[6] = (__int64)v21;
        memmove(v21, v20, 4 * v7);
        v21 += 4 * v7;
      }
      if( v12 )
      {
        v9[5] = (__int64)v21;
        v9[4] = (unsigned int)(v7 * v11);
      }
      v10 = RtlpCompressRvaList((INT64)v9, a1, v18, v19, v9[2], (__int64)&v23, (__int64)&v24);
      if( v10 < 0 )
      {
        ExFreePoolWithTag(v9, 0x4C617652u);
        v9 = 0i64;
      }
    }
    else
    {
      v10 = -1073741670;
    }
  }
  *(_QWORD *)a7 = v9;
  return v10;
}

Referenced by: