ObpCreateCacheEntry
CHAR *__fastcall ObpCreateCacheEntry(VOID *Src, size_t Size, INT64 a3, UINT64 a4){
unsigned int v4;
__int64 v6;
char *PoolWithTag;
v4 = Size;
v6 = (unsigned int)a4;
if( (int)Size + 40 < (unsigned int)Size )
return 0i64;
PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPoolCacheAligned, (unsigned int)(Size + 40), 0x6353624Fui64);
if( !PoolWithTag )
return 0i64;
*(_QWORD *)PoolWithTag = 0i64;
*(_QWORD *)(PoolWithTag + 28) = 0i64;
*((_DWORD *)PoolWithTag + 9) = 0;
*((_QWORD *)PoolWithTag + 1) = v6;
*((_QWORD *)PoolWithTag + 2) = a3;
*((_DWORD *)PoolWithTag + 6) = v4;
memmove((UINT8 *)PoolWithTag + 32, (UINT8 *)Src, v4);
return PoolWithTag;
}Referenced by:
ObLogSecurityDescriptor