EtwpUpdateSchematizedFilterData

__int64 __fastcall EtwpUpdateSchematizedFilterData(__int64 a1, char a2, __int64 a3, char a4){
  unsigned int v4; 
  void *v8; 
  UINT8 *v10; 
  UINT8 *PoolWithTag; 
  unsigned int v12; 
  v4 = 0;
  if( a4 )
  {
    v8 = *(void **)(a1 + 88);
    if( !v8 )
      return v4;
    v10 = 0i64;
  }
  else
  {
    if( *(_DWORD *)(a3 + 8) < 0x18u )
      return(unsigned int)-1073741811;
    PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, *(unsigned int *)(a3 + 8), 0x46777445ui64);
    v10 = PoolWithTag;
    if( !PoolWithTag )
      return(unsigned int)-1073741801;
    memmove(PoolWithTag, *(UINT8 **)a3, *(unsigned int *)(a3 + 8));
    v12 = *(_DWORD *)(a3 + 8);
    *((_QWORD *)v10 + 1) = 1i64 << a2;
    *((_QWORD *)v10 + 2) = v12;
    v8 = *(void **)(a1 + 88);
  }
  *(_QWORD *)(a1 + 88) = v10;
  if( v8 )
    ExFreePoolWithTag(v8, 0);
  return v4;
}

Referenced by: