PpmAllocWmiEvent

tagWNODE_SINGLE_INSTANCE *__stdcall PpmAllocWmiEvent(VOID *Context, _GUID *Guid, UINT64 DataSize, UINT64 a4){
  size_t v4; 
  ULONG v5; 
  VOID **PoolWithTag; 
  tagWNODE_SINGLE_INSTANCE *v9; 
  _GUID v10; 

  v4 = DataSize + 64;
  v5 = DataSize;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, (unsigned int)(DataSize + 64), 2001555536i64);
  v9 = (tagWNODE_SINGLE_INSTANCE *)PoolWithTag;
  if( PoolWithTag )
  {
    memset(PoolWithTag, 0i64, v4);
    v9->WnodeHeader.TimeStamp.QuadPart = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    v9->WnodeHeader.BufferSize = v4;
    v9->WnodeHeader.ProviderId = IoWMIDeviceObjectToProviderId((PDEVICE_OBJECT)Context);
    v10 = *Guid;
    v9->WnodeHeader.Flags = 138;
    v9->DataBlockOffset = 64;
    v9->WnodeHeader.Guid = v10;
    v9->SizeDataBlock = v5;
  }
  return v9;
}

Referenced by: