EtwpAllocGuidEntry

_ETW_GUID_ENTRY *__stdcall EtwpAllocGuidEntry(_GUID *Guid){
  const _GUID *v1; 
  const _GUID *v2; 
  _ETW_GUID_ENTRY *result; 
  _ETW_GUID_ENTRY *v5; 
  _GUID v6; 
  VOID *SecurityDescriptor; 

  SecurityDescriptor = 0i64;
  v2 = v1;
  result = (_ETW_GUID_ENTRY *)ExAllocatePoolWithTag(0x200ui64, 0x1A8ui64, 1199010885i64);
  v5 = result;
  if( result )
  {
    memset(result, 0i64, sizeof(_ETW_GUID_ENTRY));
    v5->RefCount = 1i64;
    v6 = *v2;
    v5->LockOwner = 0i64;
    v5->SiloState = (_ETW_SILODRIVERSTATE *)Guid;
    v5->Guid = v6;
    v5->RegListHead.Blink = &v5->RegListHead;
    v5->RegListHead.Flink = &v5->RegListHead;
    v5->SiloGuidList.Blink = &v5->SiloGuidList;
    v5->SiloGuidList.Flink = &v5->SiloGuidList;
    v5->Lock._bf_0 = 0i64;
    EtwpGetSecurityDescriptorByGuid(v2, &SecurityDescriptor);
    if( ObLogSecurityDescriptor(SecurityDescriptor, &v5->SecurityDescriptor, 1ui64) < 0 )
    {
      ExFreePoolWithTag(v5, 0);
      v5 = 0i64;
    }
    EtwpFreeSecurityDescriptor(&SecurityDescriptor);
    if( v5 )
      _InterlockedIncrement(&v5->SiloState->EtwpCounters.GuidCount);
    return v5;
  }
  return result;
}

Referenced by: