EtwpUpdatePidFilterData

NTSTATUS __stdcall EtwpUpdatePidFilterData(
        _ETW_FILTER_HEADER *GuidFilterData,
        _EVENT_FILTER_DESCRIPTOR *FilterData,
        UINT8 Remove){
  NTSTATUS v3; 
  unsigned int v6; 
  void *PidFilter; 
  v3 = 0;
  if( Remove )
  {
    ExFreePoolWithTag(GuidFilterData->PidFilter, 0);
    GuidFilterData->PidFilter = 0i64;
  }
  else
  {
    v6 = FilterData->Size >> 2;
    if( v6 <= 8 )
    {
      PidFilter = GuidFilterData->PidFilter;
      if( !PidFilter )
      {
        PidFilter = ExAllocatePoolWithTag(PagedPool, 0x24ui64, 0x46777445ui64);
        if( !PidFilter )
          return -1073741801;
        GuidFilterData->PidFilter = (_ETW_FILTER_PID *)PidFilter;
      }
      *(_DWORD *)PidFilter = v6;
      memmove((UINT8 *)PidFilter + 4, (UINT8 *)FilterData->Ptr, 4i64 * v6);
      return v3;
    }
    return -1073741811;
  }
  return v3;
}

Referenced by: