ExGetAttachedSessionPoolTagInfo

NTSTATUS __fastcall ExGetAttachedSessionPoolTagInfo(
        VOID *SystemInformation,
        UINT64 SystemInformationLength,
        UINT64 *Length,
        UINT64 SessionId){
  unsigned int v4; 
  unsigned int v5; 
  int v7; 
  int v9; 
  UINT64 v10; 
  NTSTATUS v11; 
  unsigned int v12; 
  char *v13; 
  void *v14; 
  NTSTATUS result; 
  int v16; 
  UINT64 ActualEntries; 
  UINT64 ReturnedEntries; 

  *(_DWORD *)Length = 0;
  v4 = SystemInformationLength - 16;
  LODWORD(ReturnedEntries) = 0;
  v5 = SystemInformationLength;
  LODWORD(ActualEntries) = 0;
  v7 = SessionId;
  v9 = -((unsigned int)SystemInformationLength < 0x38);
  v10 = 0i64;
  v11 = -1073741820;
  v12 = v9 & 0xC0000004;
  if( v5 >= 0x38 )
    v10 = v4;
  v13 = (char *)SystemInformation + 16;
  v14 = 0i64;
  if( v5 >= 0x38 )
    v14 = v13;
  result = ExGetSessionPoolTagInfo(v14, v10, &ReturnedEntries, &ActualEntries);
  if( result >= 0 )
  {
    v11 = v12;
    if( v5 >= 0x38 )
    {
      v16 = ReturnedEntries;
      *((_DWORD *)SystemInformation + 3) = ReturnedEntries;
      *((_DWORD *)SystemInformation + 2) = v7;
      *(_QWORD *)SystemInformation = (unsigned int)(40 * (v16 - 1) + 56);
    }
    goto LABEL_8;
  }
  if( result == -1073741820 )
  {
LABEL_8:
    result = v11;
    *(_DWORD *)Length = 40 * (ActualEntries - 1) + 56;
  }
  return result;
}

Referenced by: