PopLoggingInformation

NTSTATUS __stdcall PopLoggingInformation(PVOID *Buffer, UINT64 *a2){
  __int64 v2; 
  NTSTATUS v3; 
  int v6; 
  unsigned int v7; 
  unsigned int v8; 
  unsigned int v9; 
  unsigned int v10; 
  UINT8 *PoolWithTag; 
  UINT8 *v12; 
  __int64 v13; 
  UINT64 v14; 
  v2 = PowerStateDisableReasonListHead;
  v3 = 0;
  v6 = 0;
  v7 = 4;
  while( (__int64 *)v2 != &PowerStateDisableReasonListHead )
  {
    ++v6;
    v8 = v7 + 16;
    if( v7 + 16 < v7 )
      return -1073741675;
    v7 = v8 + *(_DWORD *)(v2 + 28);
    if( v7 < v8 )
      return -1073741675;
    v2 = *(_QWORD *)v2;
  }
  v9 = v7 + 16;
  if( v6 )
    v9 = v7;
  v10 = v9;
  PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v9, 0x66756263ui64);
  if( !PoolWithTag )
    return -1073741670;
  *(_DWORD *)a2 = v10;
  v12 = PoolWithTag + 4;
  *Buffer = PoolWithTag;
  *(_DWORD *)PoolWithTag = v10;
  if( v6 )
  {
    v13 = PowerStateDisableReasonListHead;
    while( (__int64 *)v13 != &PowerStateDisableReasonListHead && v6 )
    {
      v14 = (unsigned int)(*(_DWORD *)(v13 + 28) + 16);
      memmove(v12, (UINT8 *)(v13 + 16), v14);
      v13 = *(_QWORD *)v13;
      v12 += v14;
      --v6;
    }
  }
  else
  {
    *(_OWORD *)v12 = 0i64;
    *((_DWORD *)PoolWithTag + 3) = 0;
  }
  return v3;
}

Referenced by: