CmpAllocatePostBlock
_DWORD *__fastcall CmpAllocatePostBlock(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
int v4;
int v6;
POOL_TYPE v8;
_DWORD *PoolWithQuotaTag;
_QWORD *v10;
int v11;
_QWORD *v13;
_QWORD *v14;
v4 = a2;
v6 = a1;
v8 = 9;
PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)9, 0x48ui64, 0x62704D43ui64);
if( PoolWithQuotaTag )
{
PoolWithQuotaTag[14] = v4 | v6;
if( ((v4 | v6) & 0x10000) != 0 )
{
*((_QWORD *)PoolWithQuotaTag + 6) = 0i64;
if( (unsigned int)(v6 - 3) > 1 )
v8 = 520;
v10 = ExAllocatePoolWithQuotaTag(v8, 0x70ui64, 0x34344D43ui64);
*((_QWORD *)PoolWithQuotaTag + 8) = v10;
if( v10 )
{
v11 = v6 - 1;
if( v11 )
{
if( v11 == 2 )
{
*(_OWORD *)v10 = 0i64;
v10[2] = 0i64;
}
}
else
{
KeInitializeEvent((INT64)v10, 1, 0);
}
return PoolWithQuotaTag;
}
}
else
{
*((_QWORD *)PoolWithQuotaTag + 8) = *(_QWORD *)(a4 + 64);
v13 = ExAllocatePoolWithQuotaTag((POOL_TYPE)9, 0x18ui64, 0x35344D43ui64);
*((_QWORD *)PoolWithQuotaTag + 6) = v13;
if( v13 )
{
v13[2] = a3;
v14 = (_QWORD *)*((_QWORD *)PoolWithQuotaTag + 6);
v14[1] = v14;
*v14 = v14;
return PoolWithQuotaTag;
}
}
ExFreePoolWithTag(PoolWithQuotaTag, 0);
}
return 0i64;
}Referenced by:
NtNotifyChangeMultipleKeys