EtwpAllocatePayloadFilterData

NTSTATUS __fastcall EtwpAllocatePayloadFilterData(const _GUID *a1, __int64 a2, _QWORD *a3){
  unsigned int v3; 
  NTSTATUS result; 
  NTSTATUS v7; 
  VOID **PoolWithTag; 
  VOID **v9; 
  size_t v10; 
  _AGGREGATED_PAYLOAD_FILTER *v11; 

  v3 = *(_DWORD *)(a2 + 8);
  result = EtwpValidatePayloadFilter(a1, *(_AGGREGATED_PAYLOAD_FILTER **)a2, v3);
  v7 = result;
  if( result >= 0 )
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v3 + 8, 1182233669i64);
    v9 = PoolWithTag;
    if( PoolWithTag )
    {
      v10 = *(_DWORD *)(a2 + 8);
      v11 = *(_AGGREGATED_PAYLOAD_FILTER **)a2;
      *(_DWORD *)PoolWithTag = 1;
      memmove(PoolWithTag + 1, v11, v10);
      result = v7;
      *a3 = v9;
    }
    else
    {
      return -1073741801;
    }
  }
  return result;
}

Referenced by: