ExAllocatePool2

VOID *__fastcall ExAllocatePool2(INT64 a1, UINT64 a2, UINT64 a3){
  unsigned int v3; 
  NTSTATUS v5; 
  UINT64 v7; 
  INT64 v8; 
  POOL_TYPE PoolType[6]; 
  BYTE v10; 
  BYTE v11; 
  PoolType[0] = NonPagedPool;
  v3 = a3;
  v11 = 0;
  v10 = 0;
  if( (_DWORD)a3 )
  {
    v5 = ExpPoolFlagsToPoolType(a1, 0i64, (INT64 *)PoolType, &v11, &v10);
    if( v5 >= 0 )
    {
      if( v11 )
        return ExAllocatePoolWithQuotaTag(PoolType[0], a2, v3);
      LODWORD(v8) = v10 != 0;
      v7 = *(unsigned __int16 *)(*((_QWORD *)KeGetCurrentPrcb() + 24) + 146i64);
      LODWORD(v7) = v7 | 0x80000000;
      return ExpAllocatePoolWithTagFromNode((unsigned int)PoolType[0], a2, v3, v7, v8);
    }
  }
  else
  {
    v5 = -1073741811;
  }
  if( (a1 & 0x20) != 0 )
    RtlRaiseStatus(v5);
  return 0i64;
}

Referenced by: