FsRtlAllocateExtraCreateParameterList
NTSTATUS __stdcall FsRtlAllocateExtraCreateParameterList(UINT64 Flags, _ECP_LIST **EcpList){
_ECP_LIST *PoolWithQuotaTag;
int v4;
*EcpList = 0i64;
if( (Flags & 1) != 0 )
{
PoolWithQuotaTag = (_ECP_LIST *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, 0x18ui64, 0x6C655346ui64);
v4 = 2;
}
else
{
++dword_140CDB094;
PoolWithQuotaTag = (_ECP_LIST *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)&FsRtlEcpListLookaside);
if( !PoolWithQuotaTag )
{
++dword_140CDB098;
PoolWithQuotaTag = (_ECP_LIST *)((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD))qword_140CDB0B0)(
(unsigned int)dword_140CDB0A4,
(unsigned int)dword_140CDB0AC,
(unsigned int)dword_140CDB0A8);
}
v4 = 6;
}
if( !PoolWithQuotaTag )
return -1073741670;
PoolWithQuotaTag->Flags = v4;
PoolWithQuotaTag->Signature = 1282433861;
PoolWithQuotaTag->EcpList.Blink = &PoolWithQuotaTag->EcpList;
PoolWithQuotaTag->EcpList.Flink = &PoolWithQuotaTag->EcpList;
*EcpList = PoolWithQuotaTag;
return 0;
}Referenced by:
IopSymlinkAllocateAndAddECP
PspCreateUserProcessEcp