PpmAllocateQueryTable

_RTL_QUERY_REGISTRY_TABLE *__stdcall PpmAllocateQueryTable(UINT64 *DefaultSettingValue){
  VOID **PoolWithTag; 
  _RTL_QUERY_REGISTRY_TABLE *v3; 
  _RTL_QUERY_REGISTRY_TABLE *v4; 
  __int64 v5; 
  wchar_t **v6; 
  void **p_EntryContext; 
  wchar_t *v8; 

  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x4E8ui64, 1884115027i64);
  v3 = (_RTL_QUERY_REGISTRY_TABLE *)PoolWithTag;
  if( PoolWithTag )
  {
    memset(PoolWithTag, 0i64, 0x4E8u);
    v4 = v3 + 21;
    v5 = 20i64;
    v6 = &PpmPolicyAliasList;
    p_EntryContext = &v3->EntryContext;
    do
    {
      v8 = *v6;
      v6 += 2;
      *p_EntryContext = v4;
      v4 = (_RTL_QUERY_REGISTRY_TABLE *)((char *)v4 + 4);
      *(p_EntryContext - 1) = v8;
      p_EntryContext[2] = DefaultSettingValue;
      *((_DWORD *)p_EntryContext + 6) = 4;
      *((_DWORD *)p_EntryContext + 2) = 67108868;
      *((_DWORD *)p_EntryContext - 4) = 288;
      p_EntryContext += 7;
      --v5;
    }
    while( v5 );
  }
  return v3;
}

Referenced by: