CmpAllocatePostBlock

_DWORD *__fastcall CmpAllocatePostBlock(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
  int v4; 
  int v6; 
  POOL_TYPE v8; 
  _DWORD *PoolWithQuotaTag; 
  _QWORD *v10; 
  int v11; 
  _QWORD *v13; 
  _QWORD *v14; 

  v4 = a2;
  v6 = a1;
  v8 = 9;
  PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)9, 0x48ui64, 0x62704D43ui64);
  if( PoolWithQuotaTag )
  {
    PoolWithQuotaTag[14] = v4 | v6;
    if( ((v4 | v6) & 0x10000) != 0 )
    {
      *((_QWORD *)PoolWithQuotaTag + 6) = 0i64;
      if( (unsigned int)(v6 - 3) > 1 )
        v8 = 520;
      v10 = ExAllocatePoolWithQuotaTag(v8, 0x70ui64, 0x34344D43ui64);
      *((_QWORD *)PoolWithQuotaTag + 8) = v10;
      if( v10 )
      {
        v11 = v6 - 1;
        if( v11 )
        {
          if( v11 == 2 )
          {
            *(_OWORD *)v10 = 0i64;
            v10[2] = 0i64;
          }
        }
        else
        {
          KeInitializeEvent((INT64)v10, 1, 0);
        }
        return PoolWithQuotaTag;
      }
    }
    else
    {
      *((_QWORD *)PoolWithQuotaTag + 8) = *(_QWORD *)(a4 + 64);
      v13 = ExAllocatePoolWithQuotaTag((POOL_TYPE)9, 0x18ui64, 0x35344D43ui64);
      *((_QWORD *)PoolWithQuotaTag + 6) = v13;
      if( v13 )
      {
        v13[2] = a3;
        v14 = (_QWORD *)*((_QWORD *)PoolWithQuotaTag + 6);
        v14[1] = v14;
        *v14 = v14;
        return PoolWithQuotaTag;
      }
    }
    ExFreePoolWithTag(PoolWithQuotaTag, 0);
  }
  return 0i64;
}

Referenced by:

NtNotifyChangeMultipleKeys