VfSuspectExcludedDriversAllocateEntry

char *__fastcall VfSuspectExcludedDriversAllocateEntry(unsigned __int16 *a1, ULONG a2){
  char *PoolWithTag; 
  char *v4; 
  UINT64 v5; 
  UINT8 *v6; 
  PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, a1[1] + 32i64, a2);
  v4 = PoolWithTag;
  if( PoolWithTag )
  {
    v5 = *a1;
    *((_WORD *)PoolWithTag + 9) = a1[1];
    v6 = (UINT8 *)*((_QWORD *)a1 + 1);
    *((_QWORD *)PoolWithTag + 3) = PoolWithTag + 32;
    *((_WORD *)PoolWithTag + 8) = v5;
    memmove((UINT8 *)PoolWithTag + 32, v6, v5);
  }
  return v4;
}

Referenced by: