EtwpAllocDataBlock

INT64 __fastcall EtwpAllocDataBlock(
        UINT64 DataBlockSize,
        _ETWP_NOTIFICATION_HEADER *InDataBlock,
        _ETWP_NOTIFICATION_HEADER **OutDataBlock){
  unsigned int v3; 
  unsigned int v6; 
  UINT8 *PoolWithTag; 
  _ETWP_NOTIFICATION_HEADER *v8; 
  v3 = 0;
  *OutDataBlock = 0i64;
  if( InDataBlock && InDataBlock->NotificationSize != (_DWORD)DataBlockSize )
  {
    return(unsigned int)-1073741820;
  }
  else
  {
    v6 = DataBlockSize;
    PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned int)DataBlockSize, 0x44777445ui64);
    v8 = (_ETWP_NOTIFICATION_HEADER *)PoolWithTag;
    if( PoolWithTag )
    {
      if( InDataBlock )
        memmove(PoolWithTag, (UINT8 *)InDataBlock, v6);
      else
        memset((INT64)PoolWithTag, 0i64);
      v8->RefCount = 1;
      *OutDataBlock = v8;
    }
    else
    {
      return(unsigned int)-1073741801;
    }
  }
  return v3;
}

Referenced by: