CreateTlgAggregateSession

CHAR *__fastcall CreateTlgAggregateSession(CHAR a1, CHAR a2){
  VOID *PoolWithTag; 
  VOID *v5; 
  char *v6; 
  char *v7; 
  _QWORD *v8; 
  PEX_TIMER Timer; 
  PoolWithTag = ExAllocatePoolWithTag((_POOL_TYPE)(a1 != 0 ? PagedPool : NonPagedPoolNx), 0x178ui64, 0x47417254ui64);
  v5 = PoolWithTag;
  if( PoolWithTag )
    memset((INT64)PoolWithTag, 0i64);
  if( !v5 )
    goto LABEL_13;
  *((_QWORD *)v5 + 34) = 0i64;
  if( a2 || !a1 )
  {
    v6 = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x40ui64, 0x47417254ui64);
    v7 = v6;
    if( v6 )
      memset((INT64)v6, 0i64);
    *((_QWORD *)v5 + 33) = v7;
    if( !v7 )
      goto LABEL_13;
    KeInitializeEvent((_KEVENT *)(v7 + 32), NotificationEvent, 0);
    v8 = (_QWORD *)*((_QWORD *)v5 + 33);
    v8[2] = TlgAggregateInternalFlushWorkItemRoutineKernelMode;
    v8[3] = v5;
    *v8 = 0i64;
    *(_WORD *)(*((_QWORD *)v5 + 33) + 56i64) = 0;
    if( a2 )
    {
      Timer = ExAllocateTimer((PEXT_CALLBACK)TlgAggregateInternalFlushTimerCallbackKernelMode, *((PVOID *)v5 + 33), 8u);
      *((_QWORD *)v5 + 45) = Timer;
      if( !Timer )
      {
LABEL_13:
        DestroyAggregateSession(v5);
        return 0i64;
      }
    }
  }
  return(CHAR *)v5;
}

Referenced by: