PpmAllocWmiEvent

tagWNODE_SINGLE_INSTANCE *__stdcall PpmAllocWmiEvent(VOID *Context, GUID *Guid, UINT64 DataSize){
  ULONG v3; 
  ULONG v4; 
  tagWNODE_SINGLE_INSTANCE *PoolWithTag; 
  tagWNODE_SINGLE_INSTANCE *v8; 
  GUID v9; 
  v3 = DataSize + 64;
  v4 = DataSize;
  PoolWithTag = (tagWNODE_SINGLE_INSTANCE *)ExAllocatePoolWithTag(
                                              NonPagedPoolNx,
                                              (unsigned int)(DataSize + 64),
                                              0x774D5050ui64);
  v8 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    v8->WnodeHeader.TimeStamp.QuadPart = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    v8->WnodeHeader.BufferSize = v3;
    v8->WnodeHeader.ProviderId = IoWMIDeviceObjectToProviderId((PDEVICE_OBJECT)Context);
    v9 = *Guid;
    v8->WnodeHeader.Flags = 138;
    v8->DataBlockOffset = 64;
    v8->WnodeHeader.Guid = v9;
    v8->SizeDataBlock = v4;
  }
  return v8;
}

Referenced by: