PfSnBuildDumpFromTrace

INT64 __fastcall PfSnBuildDumpFromTrace(CHAR **a1, INT64 a2){
  int v2; 
  CHAR **v4; 
  CHAR *PoolWithTag; 
  CHAR *v6; 
  _DWORD *v7; 
  UINT8 *v8; 
  __int64 *v9; 
  int v10; 
  UINT8 *v11; 
  unsigned int v12; 
  unsigned int v13; 
  int v14; 
  UINT64 v15; 
  unsigned int v16; 
  INT64 a3; 
  LODWORD(a3) = 0;
  v2 = 0;
  *a1 = 0i64;
  v4 = a1;
  if( *(int *)(a2 + 332) < 32 )
  {
    v16 = -1073741789;
    goto LABEL_11;
  }
  if( (*(_BYTE *)(a2 + 484) & 2) != 0 )
  {
    v16 = -1072103399;
LABEL_11:
    v6 = 0i64;
    goto LABEL_12;
  }
  PoolWithTag = (CHAR *)ExAllocatePoolWithTag(
                          PagedPool,
                          ((16 * (*(_DWORD *)(a2 + 120) + *(_DWORD *)(a2 + 344)) + 215) & 0xFFFFFFF8)
                        + 8 * (*(_DWORD *)(a2 + 480) + 2 * (*(_DWORD *)(a2 + 480) + 1)),
                          0x44506343ui64);
  *v4 = PoolWithTag;
  v6 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    v7 = v6 + 16;
    *((_DWORD *)v6 + 4) = 30;
    *((_DWORD *)v6 + 5) = 1128485697;
    v8 = (UINT8 *)((unsigned __int64)(v6 + 231) & 0xFFFFFFFFFFFFFFF8ui64);
    *(_OWORD *)(v6 + 28) = *(_OWORD *)(a2 + 24);
    *(_OWORD *)(v6 + 44) = *(_OWORD *)(a2 + 40);
    *(_OWORD *)(v6 + 60) = *(_OWORD *)(a2 + 56);
    *(_OWORD *)(v6 + 76) = *(_OWORD *)(a2 + 72);
    *((_DWORD *)v6 + 23) = *(_DWORD *)(a2 + 88);
    *((_QWORD *)v6 + 21) = *(_QWORD *)(a2 + 464);
    *((_QWORD *)v6 + 15) = *(_QWORD *)(a2 + 200);
    *((_DWORD *)v6 + 44) ^= (*((_DWORD *)v6 + 44) ^ *(unsigned __int16 *)(a2 + 484)) & 1;
    *((_DWORD *)v6 + 44) ^= ((unsigned __int8)*((_DWORD *)v6 + 44) ^ (unsigned __int8)(2 * *(_WORD *)(a2 + 486))) & 2;
    *((_DWORD *)v6 + 24) = (((_DWORD)v6 + 231) & 0xFFFFFFF8) - ((_DWORD)v6 + 16);
    v9 = *(__int64 **)(a2 + 104);
    if( v9 != (__int64 *)(a2 + 104) )
    {
      do
      {
        v10 = *((_DWORD *)v9 + 4);
        v11 = (UINT8 *)v9;
        v9 = (__int64 *)*v9;
        memmove(v8, v11 + 24, (unsigned int)(16 * v10));
        v8 += (unsigned int)(16 * v10);
        v2 += v10;
      }
      while( v9 != (__int64 *)(a2 + 104) );
      v4 = a1;
    }
    *((_DWORD *)v6 + 25) = v2;
    *((_DWORD *)v6 + 26) = *(_DWORD *)(a2 + 332);
    v12 = (((_DWORD)v8 + 7) & 0xFFFFFFF8) - (_DWORD)v7;
    *((_DWORD *)v6 + 27) = *(_DWORD *)(a2 + 336);
    *((_OWORD *)v6 + 8) = *(_OWORD *)(a2 + 284);
    *((_OWORD *)v6 + 9) = *(_OWORD *)(a2 + 300);
    *((_QWORD *)v6 + 20) = *(_QWORD *)(a2 + 316);
    *((_DWORD *)v6 + 28) = v12;
    v13 = 24 * *(_DWORD *)(a2 + 480);
    memmove((UINT8 *)((unsigned __int64)(v8 + 7) & 0xFFFFFFFFFFFFFFF8ui64), *(UINT8 **)(a2 + 472), v13);
    v14 = *(_DWORD *)(a2 + 480);
    v15 = v12 + v13;
    v7[2] = v15;
    v7[25] = v14;
    if( PfVerifyTraceBuffer(v7, v15, &a3) )
      return 0;
    v6 = *v4;
    v16 = -1073741823;
  }
  else
  {
    v16 = -1073741670;
  }
LABEL_12:
  if( v6 )
  {
    ExFreePoolWithTag(v6, 0);
    *v4 = 0i64;
  }
  return v16;
}

Referenced by: