ExGetSessionPoolTagInfo

NTSTATUS __stdcall ExGetSessionPoolTagInfo(
        PVOID SystemInformation,
        UINT64 SystemInformationLength,
        UINT64 *ReturnedEntries,
        UINT64 *ActualEntries){
  unsigned int v6; 
  VOID **PoolWithTag; 
  unsigned int v8; 
  unsigned int v9; 
  _DWORD *v10; 
  unsigned int v11; 
  unsigned int v12; 
  NTSTATUS v14; 
  unsigned int v15; 
  int v16; 
  int v17; 
  VOID **v18; 
  __int64 v19; 
  VOID **v20; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  _DWORD *v22; 
  const VOID *v23; 

  v6 = SystemInformationLength;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v15 = 0;
  v17 = 0;
  v16 = 0;
  v14 = 0;
  v22 = SystemInformation;
  if( !MmAcquireSessionPoolRundown(1ui64) )
    return -1073741558;
  v18 = (VOID **)ExpSessionPoolTrackTable;
  v20 = (VOID **)((char *)ExpSessionPoolTrackTable + 56 * ExpSessionPoolTrackTableSize);
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&ExpTaggedPoolLock, &LockHandle);
  v19 = *((_QWORD *)KeGetCurrentThread()->ApcState.Process->Session + 123);
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
  if( v19 )
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 56 * v19, 1868983881i64);
    if( PoolWithTag )
    {
      KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&ExpTaggedPoolLock, &LockHandle);
      v23 = (const VOID *)*((_QWORD *)KeGetCurrentThread()->ApcState.Process->Session + 122);
      memmove(PoolWithTag, v23, 56 * v19);
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      goto LABEL_5;
    }
    MmAcquireSessionPoolRundown(0i64);
    return -1073741670;
  }
  else
  {
    PoolWithTag = 0i64;
LABEL_5:
    while( 1 )
    {
      v8 = v15;
      if( v18 >= v20 )
        break;
      if( *(_DWORD *)v18 )
      {
        ++v17;
        v9 = v15 + 40;
        v15 += 40;
        if( v8 >= 0xFFFFFFD8 )
        {
          v14 = -1073741675;
          break;
        }
        if( v9 > v6 )
        {
          v14 = -1073741820;
        }
        else
        {
          ++v16;
          v10 = v22;
          *v22 = *(_DWORD *)v18;
          v10[1] = *((_DWORD *)v18 + 10);
          v10[2] = *((_DWORD *)v18 + 12);
          *((_QWORD *)v10 + 2) = v18[4];
          v10[6] = *((_DWORD *)v18 + 4);
          v10[7] = *((_DWORD *)v18 + 6);
          *((_QWORD *)v10 + 4) = v18[1];
          v11 = v10[2];
          if( v10[1] < v11 )
            v10[1] = v11;
          v12 = v10[7];
          if( v10[6] < v12 )
            v10[6] = v12;
          v22 = v10 + 10;
        }
      }
      v18 += 7;
      if( v18 == v20 )
      {
        if( v19 )
        {
          v18 = PoolWithTag;
          v20 = &PoolWithTag[7 * v19];
          v19 = 0i64;
        }
      }
    }
    MmAcquireSessionPoolRundown(0i64);
    if( PoolWithTag )
      ExFreeHeapPool(PoolWithTag);
    *(_DWORD *)ReturnedEntries = v16;
    *(_DWORD *)ActualEntries = v17;
    return v14;
  }
}

Referenced by: