FsRtlAllocateExtraCreateParameter

NTSTATUS __stdcall FsRtlAllocateExtraCreateParameter(
        LPCGUID EcpType,
        UINT32 SizeOfContext,
        FSRTL_ALLOCATE_ECP_FLAGS Flags,
        PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback,
        UINT32 PoolTag,
        PVOID *EcpContext){
  UINT32 v6; 
  int v9; 
  int v10; 
  char *PoolWithQuotaTag; 
  GUID v12; 
  v6 = SizeOfContext + 72;
  *EcpContext = 0i64;
  if( SizeOfContext >= 0xFFFFFFB8 )
    return -1073741675;
  v9 = (Flags & 2) != 0 ? 66 : 2;
  v10 = (Flags & 2) != 0 ? 512 : 1;
  if( (Flags & 1) != 0 )
    PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)(v10 | 8), v6, PoolTag);
  else
    PoolWithQuotaTag = (char *)ExAllocatePoolWithTag((_POOL_TYPE)v10, v6, PoolTag);
  if( !PoolWithQuotaTag )
    return -1073741670;
  *((_DWORD *)PoolWithQuotaTag + 1) = 0;
  *((_QWORD *)PoolWithQuotaTag + 2) = 0i64;
  *((_QWORD *)PoolWithQuotaTag + 1) = 0i64;
  *(_DWORD *)PoolWithQuotaTag = 1215324997;
  v12 = *EcpType;
  *((_QWORD *)PoolWithQuotaTag + 7) = 0i64;
  *((_QWORD *)PoolWithQuotaTag + 8) = 0i64;
  *(GUID *)(PoolWithQuotaTag + 24) = v12;
  *((_QWORD *)PoolWithQuotaTag + 5) = CleanupCallback;
  *((_DWORD *)PoolWithQuotaTag + 12) = v9;
  *((_DWORD *)PoolWithQuotaTag + 13) = v6;
  *EcpContext = PoolWithQuotaTag + 72;
  return 0;
}

Referenced by: