PspIumAllocateSecurePool

INT64 __fastcall PspIumAllocateSecurePool(INT64 a1){
  bool v1; 
  __int64 v3; 
  __int64 v4; 
  unsigned __int64 v5; 
  __int64 v6; 
  struct _MDL *PoolWithTag; 
  __int64 v8; 
  UINT8 *MappedSystemVa; 
  __int64 v10; 
  PMDL v11; 
  UINT64 v12; 
  __int16 MdlFlags; 
  unsigned int SecurePoolMemory; 
  __int64 v15; 
  PMDL *v17; 
  PMDL v18; 
  struct _MDL v19; 
  __int64 v20; 
  PMDL MemoryDescriptorList[2]; 
  __int64 v22[3]; 
  v1 = (*(_DWORD *)(a1 + 40) & 0x2000) == 0;
  memset(&v19, 0, sizeof(v19));
  v20 = 0i64;
  v3 = 2i64;
  *(_OWORD *)MemoryDescriptorList = 0i64;
  if( v1 )
  {
    LODWORD(v4) = *(_DWORD *)(a1 + 44);
    if( (_DWORD)v4 )
    {
      v5 = *(_QWORD *)(a1 + 32) >> 12;
      v6 = 0i64;
      do
      {
        v4 = (unsigned int)(v4 - 1);
        v5 = (((8 * v5) & 0xFFF) != 0) + ((8 * v5) >> 12);
        v22[v4] = v5;
        if( (unsigned int)v6 < 2 )
        {
          PoolWithTag = (struct _MDL *)ExAllocatePoolWithTag(
                                         NonPagedPoolNx,
                                         8 * (v5 & 0xFFFFFFFFFFFFFi64) + 48,
                                         0x6C644Dui64);
          MemoryDescriptorList[v6] = PoolWithTag;
          if( !PoolWithTag )
          {
            SecurePoolMemory = -1073741670;
            goto LABEL_21;
          }
          PoolWithTag->Next = 0i64;
          PoolWithTag->StartVa = 0i64;
          PoolWithTag->ByteOffset = 0;
          PoolWithTag->ByteCount = 0;
          *(_DWORD *)&PoolWithTag->Size = 131120;
        }
        v6 = (unsigned int)(v6 + 1);
      }
      while( (_DWORD)v4 );
      v8 = 0i64;
      MappedSystemVa = (UINT8 *)(a1 + 64);
      if( !*(_DWORD *)(a1 + 44) )
        goto LABEL_20;
      while( 1 )
      {
        LODWORD(v6) = v6 - 1;
        v10 = v6 & 1;
        v11 = MemoryDescriptorList[v10];
        if( (v11->MdlFlags & 1) != 0 )
          MmUnmapLockedPages(v11->MappedSystemVa, MemoryDescriptorList[v10]);
        v12 = 8 * v22[v8];
        v11->ByteCount = LODWORD(v22[v8]) << 12;
        memmove((UINT8 *)&v11[1], MappedSystemVa, v12);
        MdlFlags = v11->MdlFlags;
        if( (MdlFlags & 5) == 0 )
        {
          MmMapLockedPagesSpecifyCache(v11, 0, MmCached, 0i64, 0, 0x40000010u);
          MdlFlags = v11->MdlFlags;
        }
        if( (MdlFlags & 1) == 0 )
          break;
        MappedSystemVa = (UINT8 *)v11->MappedSystemVa;
        v8 = (unsigned int)(v8 + 1);
        if( (unsigned int)v8 >= *(_DWORD *)(a1 + 44) )
          goto LABEL_20;
      }
    }
    else
    {
      v19.StartVa = 0i64;
      v19.ByteOffset = 0;
      v15 = *(_QWORD *)(a1 + 64);
      *(_DWORD *)&v19.Size = 131128;
      v19.ByteCount = 4096;
      v20 = v15;
      MmMapLockedPagesSpecifyCache(&v19, 0, MmCached, 0i64, 0, 0x40000010u);
      if( (v19.MdlFlags & 1) != 0 )
        goto LABEL_20;
    }
    return 3221225626i64;
  }
LABEL_20:
  SecurePoolMemory = MmAllocateSecurePoolMemory(*(PVOID *)(a1 + 24), *(PVOID *)(a1 + 32));
LABEL_21:
  if( (v19.MdlFlags & 1) != 0 )
    MmUnmapLockedPages(v19.MappedSystemVa, &v19);
  v17 = MemoryDescriptorList;
  do
  {
    v18 = *v17;
    if( *v17 )
    {
      if( (v18->MdlFlags & 1) != 0 )
        MmUnmapLockedPages(v18->MappedSystemVa, *v17);
      ExFreePoolWithTag(v18, 0);
    }
    ++v17;
    --v3;
  }
  while( v3 );
  return SecurePoolMemory;
}

Referenced by: