PspInitializeProtectedProcessParameters

INT64 __fastcall PspInitializeProtectedProcessParameters(INT64 a1){
  __int128 v2; 
  __int64 v3; 
  __int64 v4; 
  char *PoolWithTag; 
  char *v6; 
  __int64 v7; 
  char *v8; 
  *(_OWORD *)(a1 + 1000) = *(_OWORD *)(a1 + 1072);
  v2 = *(_OWORD *)(a1 + 1072);
  v3 = (unsigned __int16)(2 * (*(_WORD *)(a1 + 1072) + 42));
  *(_WORD *)(a1 + 1016) = v3;
  v4 = (unsigned __int16)(v3 + 2);
  *(_WORD *)(a1 + 1018) = v4;
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, (unsigned __int16)v4, 0x6C537350ui64);
  *(_QWORD *)(a1 + 1024) = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  *(_QWORD *)PoolWithTag = *(_QWORD *)L"Path=";
  *((_WORD *)PoolWithTag + 4) = aPath[4];
  v6 = PoolWithTag + 10;
  memmove((UINT8 *)PoolWithTag + 10, *(UINT8 **)(a1 + 1080), *(unsigned __int16 *)(a1 + 1072));
  v7 = *(unsigned __int16 *)(a1 + 1072);
  *(_OWORD *)&v6[v7] = *(_OWORD *)L"\\System32";
  *(_WORD *)&v6[v7 + 16] = aSystem32[8];
  *(_WORD *)&v6[v7 + 18] = 0;
  *(_OWORD *)&v6[v7 + 20] = *(_OWORD *)L"SystemDrive=";
  *(_QWORD *)&v6[v7 + 36] = *(_QWORD *)L"ive=";
  *(_DWORD *)&v6[v7 + 44] = **((_DWORD **)&v2 + 1);
  *(_WORD *)&v6[v7 + 48] = 0;
  *(_OWORD *)&v6[v7 + 50] = *(_OWORD *)L"SystemRoot=";
  *(_DWORD *)&v6[v7 + 66] = *(_DWORD *)L"ot=";
  *(_WORD *)&v6[v7 + 70] = aSystemroot_9[10];
  v8 = &v6[v7];
  memmove((UINT8 *)v8 + 72, *(UINT8 **)(a1 + 1080), *(unsigned __int16 *)(a1 + 1072));
  *(_DWORD *)&v8[*(unsigned __int16 *)(a1 + 1072) + 72] = 0;
  return 0i64;
}

Referenced by: