EtwpCaptureRegistryData

UINT16 __stdcall EtwpCaptureRegistryData(VOID **CapturedData, VOID *DataToCapture, UINT64 DataLength){
  size_t v3; 
  VOID **v6; 
  unsigned int v7; 
  VOID **PoolWithTag; 

  LOWORD(v3) = DataLength;
  v6 = 0i64;
  if( (_DWORD)DataLength )
  {
    v7 = 2048;
    if( (unsigned int)DataLength <= 0x800 )
      v7 = DataLength;
    v3 = v7;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v7, 829912133i64);
    v6 = PoolWithTag;
    if( PoolWithTag )
      memmove(PoolWithTag, DataToCapture, v3);
    else
      LOWORD(v3) = 0;
  }
  *CapturedData = v6;
  return v3;
}

Referenced by: