ExpStringCapture

INT64 __fastcall ExpStringCapture(WCHAR **CapturedString, UNICODE_STRING *SourceString){
  __int64 Length; 
  UINT64 v5; 
  UINT8 *PoolWithQuotaTag; 
  wchar_t *Buffer; 
  Length = SourceString->Length;
  if( (Length & 1) != 0 || !(_WORD)Length )
  {
    return(unsigned int)-1073741811;
  }
  else
  {
    v5 = SourceString->Length;
    PoolWithQuotaTag = (UINT8 *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, Length + 2, 0x50535845ui64);
    if( PoolWithQuotaTag )
    {
      if( v5 )
      {
        Buffer = SourceString->Buffer;
        if( ((unsigned __int8)Buffer & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        if( (unsigned __int64)Buffer + v5 > 0x7FFFFFFF0000i64 || (wchar_t *)((char *)Buffer + v5) < Buffer )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      memmove(PoolWithQuotaTag, (UINT8 *)SourceString->Buffer, v5);
      *(_WORD *)&PoolWithQuotaTag[2 * (v5 >> 1)] = 0;
      *CapturedString = (WCHAR *)PoolWithQuotaTag;
      return 0;
    }
    else
    {
      return(unsigned int)-1073741801;
    }
  }
}

Referenced by: