SepCaptureInt64Array
NTSTATUS __stdcall SepCaptureInt64Array(
INT64 *InputArray,
UINT64 ArrayCount,
INT8 RequestorMode,
INT64 **CapturedArray){
unsigned __int64 v6;
__int64 v7;
NTSTATUS v8;
VOID **PoolWithTag;
v6 = 8i64 * (unsigned int)ArrayCount;
v7 = 0xFFFFFFFFi64;
if( v6 <= 0xFFFFFFFF )
v7 = (unsigned int)v6;
v8 = v6 > 0xFFFFFFFF ? 0xC0000095 : 0;
if( v6 > 0xFFFFFFFF )
return v8;
PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)v7, 1950442835i64);
if( PoolWithTag )
{
if( (_DWORD)v7 )
{
if( ((unsigned __int8)InputArray & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)InputArray + v7 > 0x7FFFFFFF0000i64 || (INT64 *)((char *)InputArray + v7) < InputArray )
MEMORY[0x7FFFFFFF0000] = 0;
}
memmove(PoolWithTag, InputArray, v7);
if( v8 < 0 )
ExFreePoolWithTag(PoolWithTag, 0);
else
*CapturedArray = (INT64 *)PoolWithTag;
return v8;
}
return -1073741670;
}Referenced by:
SepCaptureTokenSecurityAttributesInformation