EtwpQueueReply
NTSTATUS __stdcall EtwpQueueReply(PRKQUEUE ReplyQueue, _ETWP_NOTIFICATION_HEADER *Reply){
int v3;
VOID **PoolWithTag;
_ETWP_NOTIFICATION_HEADER *OutDataBlock;
OutDataBlock = 0i64;
v3 = EtwpAllocDataBlock(Reply->NotificationSize, Reply, &OutDataBlock);
if( v3 < 0 )
{
_InterlockedIncrement((volatile signed __int32 *)ReplyQueue + 16);
}
else
{
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x38ui64, 1920431173i64);
if( PoolWithTag )
{
*(_OWORD *)PoolWithTag = 0i64;
*((_OWORD *)PoolWithTag + 1) = 0i64;
*((_OWORD *)PoolWithTag + 2) = 0i64;
PoolWithTag[6] = 0i64;
PoolWithTag[2] = OutDataBlock;
KeInsertQueue(ReplyQueue, (_LIST_ENTRY *)PoolWithTag);
}
else
{
v3 = -1073741801;
_InterlockedIncrement((volatile signed __int32 *)ReplyQueue + 16);
EtwpUnreferenceDataBlock(OutDataBlock);
}
}
return v3;
}Referenced by:
EtwpDeleteRegistrationObject
EtwpSendReplyDataBlock