MiAllocateAweInfo

NTSTATUS __stdcall MiAllocateAweInfo(WCHAR *SourceString){
  int v1; 
  char v2; 
  INT8 v3; 
  INT8 v4; 
  char v5; 
  char v6; 
  _DWORD *Pool; 
  _DWORD *v10; 
  __int64 v11; 
  NTSTATUS v12; 
  int AweInfoBitMap; 
  _QWORD *v14; 

  v4 = v3;
  v5 = v2;
  v6 = v1;
  *v14 = 0i64;
  if( (v1 & 0xFFFFFFFE) != 0 )
    return -1073741585;
  Pool = MiAllocatePool(64i64, 0x50ui64, 0x77416D4Dui64);
  v10 = Pool;
  if( !Pool )
    return -1073741670;
  if( (v5 & 2) != 0 )
    *((_QWORD *)Pool + 1) = 512i64;
  else
    *((_QWORD *)Pool + 1) = (v5 & 1) != 0 ? 16i64 : 1i64;
  if( (v6 & 1) != 0 )
    *Pool |= 1u;
  if( (v5 & 0x10) != 0 )
    Pool[18] = 0;
  else
    Pool[18] = ((v5 & 8) != 0) + 1;
  *((_QWORD *)Pool + 5) = 0i64;
  *((_QWORD *)Pool + 4) = SourceString;
  if( (v5 & 4) != 0 )
  {
    LODWORD(v11) = MiGetAweInfoPartition((INT64)Pool);
    if( (*(_DWORD *)(v11 + 4) & 0x40) == 0 )
    {
      v12 = -1073741637;
LABEL_18:
      ExFreePoolWithTag(v10, 0);
      return v12;
    }
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v4) )
    {
      v12 = -1073741727;
      goto LABEL_18;
    }
    *v10 |= 4u;
  }
  AweInfoBitMap = MiCreateAweInfoBitMap(v10);
  if( AweInfoBitMap < 0 )
  {
    MiDeleteAweInfo((ULONG_PTR)KeGetCurrentThread()->ApcState.Process, v10);
  }
  else
  {
    ExInitializeAutoExpandPushLock((_EX_PUSH_LOCK_AUTO_EXPAND *)(v10 + 14), 1ui64);
    *v10 |= 2u;
    if( SourceString )
    {
      *((_DWORD *)SourceString + 23) |= 0x20000u;
      *((_QWORD *)SourceString + 1) = v10;
    }
    *v14 = v10;
  }
  return AweInfoBitMap;
}

Referenced by: