ExGetSessionPoolTagInfo

NTSTATUS __stdcall ExGetSessionPoolTagInfo(
        PVOID SystemInformation,
        UINT64 SystemInformationLength,
        UINT64 *ReturnedEntries,
        UINT64 *ActualEntries){
  unsigned int v6; 
  UINT8 *PoolWithTag; 
  unsigned int v8; 
  unsigned int v9; 
  _DWORD *v10; 
  unsigned int v11; 
  unsigned int v12; 
  NTSTATUS v14; 
  unsigned int v15; 
  int v16; 
  int v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  unsigned __int64 v20; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  _DWORD *v22; 
  UINT8 *v23; 
  v6 = SystemInformationLength;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v15 = 0;
  v17 = 0;
  v16 = 0;
  v14 = 0;
  v22 = SystemInformation;
  if( !(unsigned int)MmAcquireSessionPoolRundown(1ui64) )
    return -1073741558;
  v18 = ExpSessionPoolTrackTable;
  v20 = ExpSessionPoolTrackTable + 56 * ExpSessionPoolTrackTableSize;
  KeAcquireInStackQueuedSpinLock(&ExpTaggedPoolLock, &LockHandle);
  v19 = *(_QWORD *)(*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64) + 984i64);
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
  if( v19 )
  {
    PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, 56 * v19, 0x6F666E49ui64);
    if( PoolWithTag )
    {
      KeAcquireInStackQueuedSpinLock(&ExpTaggedPoolLock, &LockHandle);
      v23 = *(UINT8 **)(*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64) + 976i64);
      memmove(PoolWithTag, v23, 56 * v19);
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      goto LABEL_5;
    }
    MmAcquireSessionPoolRundown(0i64);
    return -1073741670;
  }
  else
  {
    PoolWithTag = 0i64;
LABEL_5:
    while( 1 )
    {
      v8 = v15;
      if( v18 >= v20 )
        break;
      if( *(_DWORD *)v18 )
      {
        ++v17;
        v9 = v15 + 40;
        v15 += 40;
        if( v8 >= 0xFFFFFFD8 )
        {
          v14 = -1073741675;
          break;
        }
        if( v9 > v6 )
        {
          v14 = -1073741820;
        }
        else
        {
          ++v16;
          v10 = v22;
          *v22 = *(_DWORD *)v18;
          v10[1] = *(_DWORD *)(v18 + 40);
          v10[2] = *(_DWORD *)(v18 + 48);
          *((_QWORD *)v10 + 2) = *(_QWORD *)(v18 + 32);
          v10[6] = *(_DWORD *)(v18 + 16);
          v10[7] = *(_DWORD *)(v18 + 24);
          *((_QWORD *)v10 + 4) = *(_QWORD *)(v18 + 8);
          v11 = v10[2];
          if( v10[1] < v11 )
            v10[1] = v11;
          v12 = v10[7];
          if( v10[6] < v12 )
            v10[6] = v12;
          v22 = v10 + 10;
        }
      }
      v18 += 56i64;
      if( v18 == v20 )
      {
        if( v19 )
        {
          v18 = (unsigned __int64)PoolWithTag;
          v20 = (unsigned __int64)&PoolWithTag[56 * v19];
          v19 = 0i64;
        }
      }
    }
    MmAcquireSessionPoolRundown(0i64);
    if( PoolWithTag )
      ExFreeHeapPool(PoolWithTag);
    *(_DWORD *)ReturnedEntries = v16;
    *(_DWORD *)ActualEntries = v17;
    return v14;
  }
}

Referenced by: