EtwpCaptureRegistryData

UINT16 __fastcall EtwpCaptureRegistryData(VOID **CapturedData, VOID *DataToCapture, UINT64 DataLength){
  UINT64 v3; 
  UINT8 *v6; 
  unsigned int v7; 
  UINT8 *PoolWithTag; 
  LOWORD(v3) = DataLength;
  v6 = 0i64;
  if( (_DWORD)DataLength )
  {
    v7 = 2048;
    if( (unsigned int)DataLength <= 0x800 )
      v7 = DataLength;
    v3 = v7;
    PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v7, 0x31777445ui64);
    v6 = PoolWithTag;
    if( PoolWithTag )
      memmove(PoolWithTag, (UINT8 *)DataToCapture, v3);
    else
      LOWORD(v3) = 0;
  }
  *CapturedData = v6;
  return v3;
}

Referenced by: