FsRtlAllocateExtraCreateParameterFromLookasideList

NTSTATUS __stdcall FsRtlAllocateExtraCreateParameterFromLookasideList(
        _LPCGUID EcpType,
        ULONG SizeOfContext,
        _FSRTL_ALLOCATE_ECP_FLAGS Flags,
        PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback,
        PVOID LookasideList,
        PVOID *EcpContext){
  ULONG v6; 
  int v8; 
  __int128 *v9; 
  char *v10; 
  __int128 v11; 

  v6 = SizeOfContext + 72;
  v8 = 66;
  v9 = *(__int128 **)&EcpType;
  if( (Flags & 2) == 0 )
    v8 = 2;
  if( v6 > *((_DWORD *)LookasideList + 11) )
    return FsRtlAllocateExtraCreateParameter(
             EcpType,
             SizeOfContext,
             (unsigned __int8)Flags,
             CleanupCallback,
             *((_DWORD *)LookasideList + 10),
             EcpContext);
  if( (Flags & 2) != 0 )
  {
    v10 = (char *)ExAllocateFromNPagedLookasideList((_NPAGED_LOOKASIDE_LIST *)LookasideList);
  }
  else
  {
    ++*((_DWORD *)LookasideList + 5);
    v10 = (char *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)LookasideList);
    if( v10 )
    {
LABEL_6:
      *(_QWORD *)v10 = 1215324997i64;
      *((_QWORD *)v10 + 2) = 0i64;
      *((_QWORD *)v10 + 1) = 0i64;
      v11 = *v9;
      *((_QWORD *)v10 + 8) = 0i64;
      *((_QWORD *)v10 + 5) = CleanupCallback;
      *(_OWORD *)(v10 + 24) = v11;
      *((_DWORD *)v10 + 12) = v8;
      *((_DWORD *)v10 + 13) = v6;
      *((_QWORD *)v10 + 7) = LookasideList;
      *EcpContext = v10 + 72;
      return 0;
    }
    ++*((_DWORD *)LookasideList + 6);
    v10 = (char *)(*((__int64(__fastcall **)(_QWORD, _QWORD, _QWORD))LookasideList + 6))(
                    *((unsigned int *)LookasideList + 9),
                    *((unsigned int *)LookasideList + 11),
                    *((unsigned int *)LookasideList + 10));
  }
  if( v10 )
    goto LABEL_6;
  *EcpContext = 0i64;
  return -1073741670;
}

Referenced by:

IopSymlinkAllocateAndAddECP
IopSymlinkPropagateToExtensionIfNeeded