EtwpTiAllocVadQueryEventWriteWorkItemContext

NTSTATUS __stdcall EtwpTiAllocVadQueryEventWriteWorkItemContext(
        INT64 a1,
        UINT64 a2,
        UINT64 a3,
        VOID *a4,
        VOID *Src,
        UINT64 a6,
        INT64 a7,
        CHAR **a8){
  unsigned int v8; 
  __int64 v9; 
  unsigned int v10; 
  _DWORD *v12; 
  unsigned int v13; 
  unsigned __int64 v14; 
  unsigned int v15; 
  unsigned int v16; 
  unsigned __int64 v17; 
  VOID **PoolWithTag; 
  VOID **v19; 
  char *v20; 
  size_t *v21; 
  INT64 v22; 
  __int64 v23; 
  size_t v24; 
  char *v25; 
  __int64 v26; 
  VOID *v27; 

  v8 = 0;
  v9 = (unsigned int)a3;
  v10 = 0;
  if( (_DWORD)a3 )
  {
    v12 = (_DWORD *)(a1 + 8);
    do
    {
      v13 = v8 + *v12;
      if( v13 < v8 )
        return -1073741675;
      ++v10;
      v12 += 4;
      v8 = v13;
    }
    while( v10 < (unsigned int)a3 );
  }
  v14 = 16i64 * (unsigned int)a2;
  if( v14 > 0xFFFFFFFF )
    return -1073741675;
  v15 = v14 + 80;
  if( (unsigned int)v14 >= 0xFFFFFFB0 )
    return -1073741675;
  v16 = v15 + v8;
  if( v15 + v8 < v15 )
    return -1073741675;
  v17 = 8i64 * (unsigned int)a6;
  if( v17 > 0xFFFFFFFF || v16 + (unsigned int)v17 < v16 )
    return -1073741675;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v16 + (unsigned int)v17, 1853049172i64);
  v19 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  PoolWithTag[4] = PoolWithTag + 10;
  v20 = (char *)PoolWithTag + (unsigned int)v14 + 80;
  PoolWithTag[5] = v20;
  PoolWithTag[9] = &v20[v8];
  if( (_DWORD)v9 )
  {
    v21 = (size_t *)(a1 + 8);
    v22 = -8 - a1;
    v23 = v9;
    do
    {
      memmove(v20, *((const VOID **)v21 - 1), *v21);
      v24 = *v21;
      v25 = (char *)v21 + v22 + (_QWORD)v19[4];
      *((_DWORD *)v25 + 3) = 0;
      *(_QWORD *)v25 = v20;
      *((_DWORD *)v25 + 2) = v24;
      v26 = *v21;
      v21 += 4;
      v20 += v26;
      --v23;
    }
    while( v23 );
  }
  *((_DWORD *)v19 + 12) = v9;
  ObfReferenceObjectWithTag(a4, 0x69547445ui64);
  v27 = v19[9];
  v19[8] = a4;
  memmove(v27, Src, v17);
  v19[7] = (VOID *)a7;
  *((_DWORD *)v19 + 13) = a6;
  *a8 = (CHAR *)v19;
  return 0;
}

Referenced by: