FsRtlAllocateExtraCreateParameterList

NTSTATUS __stdcall FsRtlAllocateExtraCreateParameterList(UINT64 Flags, _ECP_LIST **EcpList){
  _ECP_LIST *PoolWithQuotaTag; 
  int v4; 
  *EcpList = 0i64;
  if( (Flags & 1) != 0 )
  {
    PoolWithQuotaTag = (_ECP_LIST *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, 0x18ui64, 0x6C655346ui64);
    v4 = 2;
  }
  else
  {
    ++dword_140CDB094;
    PoolWithQuotaTag = (_ECP_LIST *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)&FsRtlEcpListLookaside);
    if( !PoolWithQuotaTag )
    {
      ++dword_140CDB098;
      PoolWithQuotaTag = (_ECP_LIST *)((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD))qword_140CDB0B0)(
                                        (unsigned int)dword_140CDB0A4,
                                        (unsigned int)dword_140CDB0AC,
                                        (unsigned int)dword_140CDB0A8);
    }
    v4 = 6;
  }
  if( !PoolWithQuotaTag )
    return -1073741670;
  PoolWithQuotaTag->Flags = v4;
  PoolWithQuotaTag->Signature = 1282433861;
  PoolWithQuotaTag->EcpList.Blink = &PoolWithQuotaTag->EcpList;
  PoolWithQuotaTag->EcpList.Flink = &PoolWithQuotaTag->EcpList;
  *EcpList = PoolWithQuotaTag;
  return 0;
}

Referenced by:

IopSymlinkAllocateAndAddECP
PspCreateUserProcessEcp