CmpGetValueForAudit

__int64 __fastcall CmpGetValueForAudit(__int64 a1, __int64 a2, __int64 a3, ULONG a4){
  unsigned int v4; 
  __int64(__fastcall *v8)(__int64, __int64, __int64 *); 
  unsigned int v9; 
  UINT8 *v10; 
  INT64 v11; 
  INT64 v12; 
  unsigned int v13; 
  _CHILD_LIST *v14; 
  UINT8 *v15; 
  int v16; 
  SIZE_T NumberOfBytes; 
  INT64 v19; 
  __int64 v20; 
  void *Src; 
  INT64 v22; 
  v4 = 0;
  v19 = 0xFFFFFFFFi64;
  v20 = 0xFFFFFFFFi64;
  v8 = *(__int64(__fastcall **)(__int64, __int64, __int64 *))(a1 + 8);
  v9 = a2;
  Src = 0i64;
  v10 = 0i64;
  LOBYTE(v22) = 0;
  v11 = v8(a1, a2, &v20);
  v12 = v11;
  if( !v11 )
    return(unsigned int)-1073741670;
  LODWORD(NumberOfBytes) = 0;
  if( !*(_DWORD *)(v11 + 4) )
    goto LABEL_9;
  if( CmpGetValueData(a1, v9, v11, &NumberOfBytes, (INT64)&Src, (INT64)&v22, (INT64)&v19) )
  {
    v4 = NumberOfBytes;
    if( (_DWORD)NumberOfBytes )
    {
      CmpAllocateTransientPoolWithTag((_HHIVE *)1, (unsigned int)NumberOfBytes, a4, v14);
      v10 = v15;
      if( !v15 )
        goto LABEL_5;
      memmove(v15, (UINT8 *)Src, v4);
    }
LABEL_9:
    v16 = *(_DWORD *)(v12 + 12);
    *(_DWORD *)(a3 + 4) = v4;
    v13 = 0;
    *(_DWORD *)a3 = v16;
    *(_QWORD *)(a3 + 8) = v10;
    goto LABEL_10;
  }
LABEL_5:
  v13 = -1073741670;
LABEL_10:
  if( Src )
  {
    if( (_BYTE)v22 )
      ExFreePoolWithTag(Src, 0);
    else(*(void(__fastcall **)(__int64, INT64 *))(a1 + 16))(a1, &v19);
  }
  (*(void(__fastcall **)(__int64, __int64 *))(a1 + 16))(a1, &v20);
  return v13;
}

Referenced by: