ExpStringCapture

NTSTATUS __stdcall ExpStringCapture(WCHAR **CapturedString, _UNICODE_STRING *SourceString){
  __int64 Length; 
  unsigned __int64 v5; 
  VOID *PoolWithQuotaTag; 
  wchar_t *Buffer; 

  Length = SourceString->Length;
  if( (Length & 1) != 0 || !(_WORD)Length )
    return -1073741811;
  v5 = SourceString->Length;
  PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)9, Length + 2, 0x50535845ui64);
  if( !PoolWithQuotaTag )
    return -1073741801;
  if( v5 )
  {
    Buffer = SourceString->Buffer;
    if( ((unsigned __int8)Buffer & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)Buffer + v5 > 0x7FFFFFFF0000i64 || (wchar_t *)((char *)Buffer + v5) < Buffer )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  memmove(PoolWithQuotaTag, SourceString->Buffer, v5);
  *((_WORD *)PoolWithQuotaTag + (v5 >> 1)) = 0;
  *CapturedString = (WCHAR *)PoolWithQuotaTag;
  return 0;
}

Referenced by: