PoDiagCaptureUsermodeStack

VOID **__stdcall PoDiagCaptureUsermodeStack(){
  VOID **PoolWithTag; 
  VOID **v1; 
  int v2; 
  PoolWithTag = (VOID **)ExAllocatePoolWithTag(PagedPool, 0x108ui64, 0x50455654ui64);
  v1 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    v2 = RtlWalkFrameChain(v1 + 1, 0x20ui64, 1ui64);
    if( v2 )
    {
      *(_DWORD *)v1 = v2;
    }
    else
    {
      ExFreePoolWithTag(v1, 0x50455654u);
      return 0i64;
    }
  }
  return v1;
}

Referenced by:

NtSetTimerResolution