ExpGetSystemFlushInformation

NTSTATUS __stdcall ExpGetSystemFlushInformation(INT64 a1){
  int v2; 
  __int64 v4; 
  unsigned int v5; 
  VOID **PoolWithTag; 
  unsigned int *v7; 
  __int64 v8; 
  unsigned int *v9; 
  unsigned int *v10; 
  unsigned int *i; 
  __int64 v12; 
  char *v13; 
  _DWORD ReturnedLength[5]; 
  int SystemInformation[3]; 
  __int64 v16; 

  *(_QWORD *)&ReturnedLength[3] = a1;
  v2 = ((unsigned __int64)KeFeatureBits >> 34) & 4 | 1;
  if( ((unsigned __int64)KeFeatureBits & 0x800000000i64) != 0 )
    v2 = ((unsigned __int64)KeFeatureBits >> 34) & 4 | 3;
  *(_DWORD *)a1 = v2;
  *(_DWORD *)(a1 + 4) = KeGetCurrentPrcb()->CFlushSize;
  *(_QWORD *)(a1 + 8) = 0i64;
  *(_QWORD *)(a1 + 16) = 0i64;
  *(_QWORD *)(a1 + 24) = 0i64;
  if( !*(&WheapErrorSourceTable + 1000) )
  {
    v4 = 0i64;
    v16 = 0i64;
    ReturnedLength[0] = 0;
    SystemInformation[0] = 1094930505;
    SystemInformation[1] = 1;
    SystemInformation[2] = 1414088270;
    if( ExpGetSystemFirmwareTableInformation(SystemInformation, 0, 0x14ui64, (UINT64 *)ReturnedLength) == -1073741789 )
    {
      v5 = ReturnedLength[0];
      PoolWithTag = ExAllocatePoolWithTag(1ui64, ReturnedLength[0], 1413632087i64);
      v7 = (unsigned int *)PoolWithTag;
      if( PoolWithTag )
      {
        *(_DWORD *)PoolWithTag = 1094930505;
        *((_DWORD *)PoolWithTag + 1) = 1;
        *((_DWORD *)PoolWithTag + 2) = 1414088270;
        *((_DWORD *)PoolWithTag + 3) = v5 - 16;
        if( ExpGetSystemFirmwareTableInformation(PoolWithTag, 0, v5, (UINT64 *)ReturnedLength) >= 0 )
        {
          v8 = v7[5];
          if( (unsigned int)v8 >= ReturnedLength[0] - 16 )
          {
            v9 = (unsigned int *)((char *)v7 + v8 + 16);
            v10 = v7 + 14;
            for( i = v7 + 15; i <= v9; i = (unsigned int *)(v13 + 4) )
            {
              v12 = *((unsigned __int16 *)v10 + 1);
              v13 = (char *)v10 + v12;
              if( (unsigned int *)((char *)v10 + v12) > v9 || !(_WORD)v12 )
                break;
              if( *(_WORD *)v10 == 7 && (unsigned int)v12 >= 0x10 )
              {
                if( (v10[2] & 1) != 0 )
                  v4 = 1i64;
                break;
              }
              v10 = (unsigned int *)((char *)v10 + v12);
            }
          }
        }
        ExFreePoolWithTag(v7, 0);
      }
    }
    *(&WheapErrorSourceTable + 126) = v4;
    *(&WheapErrorSourceTable + 1000) = 1;
  }
  *(_QWORD *)(a1 + 8) = *(&WheapErrorSourceTable + 126);
  return 0;
}

Referenced by: