ExGetPoolTagInfo

NTSTATUS __stdcall ExGetPoolTagInfo(PVOID SystemInformation, UINT64 SystemInformationLength, UINT64 *ReturnLength){
  unsigned int v4; 
  __int64 v6; 
  __int64 v7; 
  UINT64 v8; 
  _DWORD *PoolWithTag; 
  _DWORD *v10; 
  _DWORD *v11; 
  _DWORD *v12; 
  unsigned int v13; 
  unsigned int v14; 
  unsigned int v15; 
  int v17; 
  NTSTATUS v18; 
  _DWORD *v19; 
  char *v20; 
  __int64 Context[10]; 
  v4 = SystemInformationLength;
  v18 = 0;
  v20 = (char *)SystemInformation + 8;
  v17 = 8;
  *(_DWORD *)SystemInformation = 0;
  v6 = PoolTrackTableSize;
  v7 = PoolTrackTableExpansionSize;
  v8 = 56 * PoolTrackTableSize + 56 * PoolTrackTableExpansionSize;
  if( v8 < 56 * PoolTrackTableSize )
    return -1073741670;
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, v8, 0x6F666E49ui64);
  v10 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  Context[0] = (__int64)PoolWithTag;
  Context[1] = PoolTrackTableSize;
  Context[2] = (__int64)&PoolWithTag[14 * PoolTrackTableSize];
  Context[3] = v7;
  KeGenericCallDpc(ExpGetPoolTagInfoTarget, Context);
  v11 = v10;
  v19 = v10;
  while( v11 < &v10[14 * v7 + 14 * v6] )
  {
    if( !*v11 )
      goto LABEL_6;
    ++*(_DWORD *)SystemInformation;
    v13 = v17 + 40;
    v17 = v13;
    if( v13 < 0x28 )
    {
      v18 = -1073741675;
      break;
    }
    if( v4 < v13 )
    {
      v18 = -1073741820;
LABEL_6:
      v12 = v19;
      goto LABEL_7;
    }
    *(_DWORD *)v20 = *v19;
    v12 = v19;
    *((_DWORD *)v20 + 1) = v19[10];
    *((_DWORD *)v20 + 2) = v19[12];
    *((_QWORD *)v20 + 2) = *((_QWORD *)v19 + 4);
    *((_DWORD *)v20 + 6) = v19[4];
    *((_DWORD *)v20 + 7) = v19[6];
    *((_QWORD *)v20 + 4) = *((_QWORD *)v19 + 1);
    v14 = *((_DWORD *)v20 + 2);
    if( *((_DWORD *)v20 + 1) < v14 )
      *((_DWORD *)v20 + 1) = v14;
    v15 = *((_DWORD *)v20 + 7);
    if( *((_DWORD *)v20 + 6) < v15 )
      *((_DWORD *)v20 + 6) = v15;
    v20 += 40;
LABEL_7:
    v11 = v12 + 14;
    v19 = v11;
  }
  ExFreePoolWithTag(v10, 0);
  if( ReturnLength )
    *(_DWORD *)ReturnLength = v17;
  return v18;
}

Referenced by: