EtwpQueryPersistedMemory

__int64 __fastcall EtwpQueryPersistedMemory(__int64 a1, __int64 a2, _QWORD *a3, unsigned int *a4){
  int v7; 
  int v8; 
  VOID **PoolWithTag; 
  unsigned int v11; 
  int v12; 

  v12 = HIDWORD(a1);
  v11 = 0;
  v7 = KsrClaimPersistedMemory(EtwpKsrGuid, a2, 0i64, 0i64, 0, &v11);
  v8 = v7;
  if( v7 == -1073741789 )
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 8i64 * v11, 1266119749i64);
    if( PoolWithTag )
    {
      v8 = KsrClaimPersistedMemory(EtwpKsrGuid, a2, PoolWithTag, v11, 0, &v11);
      if( v8 < 0 )
      {
        ExFreePoolWithTag(PoolWithTag, 0);
      }
      else
      {
        *a4 = v11;
        *a3 = PoolWithTag;
      }
    }
    else
    {
      return(unsigned int)-1073741670;
    }
  }
  else if( v7 >= 0 )
  {
    return(unsigned int)-1073741823;
  }
  return(unsigned int)v8;
}

Referenced by: