WheapSaveRecordForLiveDump

NTSTATUS __stdcall WheapSaveRecordForLiveDump(INT64 a1){
  size_t v1; 
  NTSTATUS v3; 
  VOID **PoolWithTag; 
  VOID ***v5; 

  v1 = *(_DWORD *)(a1 + 60);
  if( v1 + 32 < v1 )
    return -1073741675;
  v3 = 0;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v1 + 32, 1634035799i64);
  if( !PoolWithTag )
    return -1073741670;
  *((_DWORD *)PoolWithTag + 4) = *(_DWORD *)(*(_QWORD *)(a1 + 32) + 40i64);
  PoolWithTag[3] = PoolWithTag + 4;
  memmove(PoolWithTag + 4, (const VOID *)(a1 + 40), v1);
  ExAcquireFastMutex((PFAST_MUTEX)((char *)&SbiVmbusArrivalEvent + 2976));
  v5 = (VOID ***)*(&SbiVmbusArrivalEvent + 369);
  if( (_UNKNOWN *)**(&SbiVmbusArrivalEvent + 369) != (_UNKNOWN *)((char *)&SbiVmbusArrivalEvent + 2944) )
    __fastfail(3u);
  *PoolWithTag = (char *)&SbiVmbusArrivalEvent + 2944;
  PoolWithTag[1] = v5;
  *v5 = PoolWithTag;
  *(&SbiVmbusArrivalEvent + 369) = PoolWithTag;
  KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&SbiVmbusArrivalEvent + 2976));
  return v3;
}

Referenced by: