SepCaptureInt64Array

NTSTATUS __stdcall SepCaptureInt64Array(
        INT64 *InputArray,
        UINT64 ArrayCount,
        INT8 RequestorMode,
        INT64 **CapturedArray){
  unsigned __int64 v6; 
  __int64 v7; 
  NTSTATUS v8; 
  VOID **PoolWithTag; 

  v6 = 8i64 * (unsigned int)ArrayCount;
  v7 = 0xFFFFFFFFi64;
  if( v6 <= 0xFFFFFFFF )
    v7 = (unsigned int)v6;
  v8 = v6 > 0xFFFFFFFF ? 0xC0000095 : 0;
  if( v6 > 0xFFFFFFFF )
    return v8;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)v7, 1950442835i64);
  if( PoolWithTag )
  {
    if( (_DWORD)v7 )
    {
      if( ((unsigned __int8)InputArray & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      if( (unsigned __int64)InputArray + v7 > 0x7FFFFFFF0000i64 || (INT64 *)((char *)InputArray + v7) < InputArray )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    memmove(PoolWithTag, InputArray, v7);
    if( v8 < 0 )
      ExFreePoolWithTag(PoolWithTag, 0);
    else
      *CapturedArray = (INT64 *)PoolWithTag;
    return v8;
  }
  return -1073741670;
}

Referenced by:

SepCaptureTokenSecurityAttributesInformation