ExpSetKernelDataProtection

__int64 __fastcall ExpSetKernelDataProtection(__int64 a1, __int64 a2, char a3, char a4){
  void *v7; 
  INT64 *v8; 
  INT64 *v9; 
  INT64 PoolWithTag; 
  INT64 *v11; 
  INT64 *v12; 
  char v13; 
  unsigned int v14; 
  int v16; 
  PVOID P; 
  INT64 *v18; 
  INT64 a1a; 
  v7 = 0i64;
  P = 0i64;
  v8 = 0i64;
  v18 = 0i64;
  if( !a2 )
  {
    v14 = -1073741811;
    goto LABEL_26;
  }
  if( (a4 & 1) == 0 && !*(_QWORD *)(a1 + 46832) )
  {
    v14 = 0;
    goto LABEL_26;
  }
  ExAcquirePushLockExclusiveEx(a1 + 47024, 0i64);
  v9 = *(INT64 **)(a1 + 47016);
  if( v9 )
  {
    a1a = *v9;
    v16 = sub_14061BF48(&a1a);
    if( v16 >= 0 )
    {
      PoolWithTag = a1a;
LABEL_7:
      if( (a3 & 1) != 0 )
        *(_QWORD *)PoolWithTag = *(_QWORD *)a2;
      if( (a3 & 2) != 0 )
        *(_DWORD *)(PoolWithTag + 8) = *(_DWORD *)(a2 + 8);
      if( (a3 & 4) != 0 )
        *(_QWORD *)(PoolWithTag + 16) = *(_QWORD *)(a2 + 16);
      if( (a3 & 8) != 0 )
        *(_QWORD *)(PoolWithTag + 24) = *(_QWORD *)(a2 + 24);
      if( (a3 & 0x10) != 0 )
        *(_QWORD *)(PoolWithTag + 32) = *(_QWORD *)(a2 + 32);
      if( (a3 & 0x20) != 0 )
        *(_BYTE *)(PoolWithTag + 40) = *(_BYTE *)(a2 + 40);
    }
  }
  else
  {
    PoolWithTag = (INT64)ExAllocatePoolWithTag(PagedPool, 0x30ui64, 0x20534C53ui64);
    P = (PVOID)PoolWithTag;
    if( PoolWithTag
      && (v11 = (INT64 *)ExAllocatePoolWithTag(PagedPool, 8ui64, 0x20534C53ui64), v12 = v11, (v18 = v11) != 0i64) )
    {
      *v11 = PoolWithTag;
      a1a = PoolWithTag;
      *(_QWORD *)PoolWithTag = 0i64;
      *(_QWORD *)(PoolWithTag + 16) = 0i64;
      *(_DWORD *)(PoolWithTag + 8) = 4;
      *(_QWORD *)(PoolWithTag + 24) = 0i64;
      *(_QWORD *)(PoolWithTag + 32) = 0i64;
      *(_BYTE *)(PoolWithTag + 40) = 1;
      v16 = sub_1407BEAC4(v11);
      if( v16 >= 0 )
      {
        *(_QWORD *)(a1 + 47016) = v12;
        P = 0i64;
        v18 = 0i64;
        goto LABEL_7;
      }
    }
    else
    {
      v16 = -1073741801;
    }
  }
  v13 = _InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 47024), 0xFFFFFFFFFFFFFFFFui64);
  if( (v13 & 2) != 0 && (v13 & 4) == 0 )
    ExfTryToWakePushLock((volatile INT64 *)(a1 + 47024));
  KeAbPostRelease((PVOID)(a1 + 47024));
  v14 = v16;
  v7 = P;
  v8 = v18;
LABEL_26:
  if( v7 )
    ExFreePoolWithTag(v7, 0);
  if( v8 )
    ExFreePoolWithTag(v8, 0);
  return v14;
}

Referenced by: