MiCreateAweInfoBitMap

NTSTATUS __stdcall MiCreateAweInfoBitMap(_EX_CALLBACK_ROUTINE_BLOCK *CallBackBlock){
  _EPROCESS *Process; 
  __int64 v3; 
  __int64 v4; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  void *Pool; 
  NTSTATUS result; 
  int v11; 

  Process = KeGetCurrentThread()->ApcState.Process;
  LODWORD(v3) = MiGetAweInfoPartition((INT64)CallBackBlock);
  v4 = *(_QWORD *)(v3 + 6920);
  WoW64Process = Process->WoW64Process;
  if( WoW64Process )
  {
    Machine = WoW64Process->Machine;
    if( (Machine == 332 || Machine == 452) && (unsigned __int64)(v4 + 1) > 0x100000000i64 )
      v4 = 0xFFFFFFFFi64;
  }
  ExGetCallBackBlockRoutine(CallBackBlock);
  if( v7 == 1 )
    v8 = v4 + 1;
  else
    v8 = (~(v7 - 1) & (v4 + v7 - 1)) / v7;
  Pool = MiAllocatePool(64i64, 8 * ((v8 >> 6) + ((v8 & 0x3F) != 0)), 0x4C646156ui64);
  if( !Pool )
    return -1073741670;
  if( (*CallBackBlock & 1) != 0
    && (v11 = PsChargeProcessNonPagedPoolQuota(Process, 8 * ((v8 >> 6) + ((v8 & 0x3F) != 0))), v11 < 0) )
  {
    ExFreePoolWithTag(Pool, 0);
    return v11;
  }
  else
  {
    *((_QWORD *)CallBackBlock + 2) = v8;
    result = 0;
    *((_QWORD *)CallBackBlock + 3) = Pool;
  }
  return result;
}

Referenced by: