EtwpTiAllocVadQueryEventWriteWorkItemContext

INT64 __fastcall EtwpTiAllocVadQueryEventWriteWorkItemContext(
        INT64 a1,
        UINT64 a2,
        UINT64 a3,
        VOID *a4,
        VOID *Src,
        UINT64 a6,
        INT64 a7,
        CHAR **a8){
  unsigned int v8; 
  __int64 v9; 
  unsigned int v10; 
  _DWORD *v12; 
  unsigned int v13; 
  unsigned __int64 v14; 
  unsigned int v15; 
  unsigned int v16; 
  unsigned __int64 v17; 
  _QWORD *PoolWithTag; 
  _QWORD *v19; 
  UINT8 *v20; 
  UINT8 **v21; 
  INT64 v22; 
  __int64 v23; 
  int v24; 
  char *v25; 
  __int64 v26; 
  UINT8 *v27; 
  v8 = 0;
  v9 = (unsigned int)a3;
  v10 = 0;
  if( (_DWORD)a3 )
  {
    v12 = (_DWORD *)(a1 + 8);
    do
    {
      v13 = v8 + *v12;
      if( v13 < v8 )
        return 3221225621i64;
      ++v10;
      v12 += 4;
      v8 = v13;
    }
    while( v10 < (unsigned int)a3 );
  }
  v14 = 16i64 * (unsigned int)a2;
  if( v14 > 0xFFFFFFFF )
    return 3221225621i64;
  v15 = v14 + 80;
  if( (unsigned int)v14 >= 0xFFFFFFB0 )
    return 3221225621i64;
  v16 = v15 + v8;
  if( v15 + v8 < v15 )
    return 3221225621i64;
  v17 = 8i64 * (unsigned int)a6;
  if( v17 > 0xFFFFFFFF || v16 + (unsigned int)v17 < v16 )
    return 3221225621i64;
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, v16 + (unsigned int)v17, 0x6E734954ui64);
  v19 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225495i64;
  PoolWithTag[4] = PoolWithTag + 10;
  v20 = (UINT8 *)PoolWithTag + (unsigned int)v14 + 80;
  PoolWithTag[5] = v20;
  PoolWithTag[9] = &v20[v8];
  if( (_DWORD)v9 )
  {
    v21 = (UINT8 **)(a1 + 8);
    v22 = -8 - a1;
    v23 = v9;
    do
    {
      memmove(v20, *(v21 - 1), *(unsigned int *)v21);
      v24 = *(_DWORD *)v21;
      v25 = (char *)v21 + v22 + v19[4];
      *((_DWORD *)v25 + 3) = 0;
      *(_QWORD *)v25 = v20;
      *((_DWORD *)v25 + 2) = v24;
      v26 = *(unsigned int *)v21;
      v21 += 2;
      v20 += v26;
      --v23;
    }
    while( v23 );
  }
  *((_DWORD *)v19 + 12) = v9;
  ObfReferenceObjectWithTag(a4, 0x69547445u);
  v27 = (UINT8 *)v19[9];
  v19[8] = a4;
  memmove(v27, (UINT8 *)Src, (unsigned int)v17);
  v19[7] = a7;
  *((_DWORD *)v19 + 13) = a6;
  *a8 = (CHAR *)v19;
  return 0i64;
}

Referenced by: