EtwpQueueReply
INT64 __fastcall EtwpQueueReply(_ETW_REPLY_QUEUE *ReplyQueue, _ETWP_NOTIFICATION_HEADER *Reply){
int v3;
_LIST_ENTRY *PoolWithTag;
_ETWP_NOTIFICATION_HEADER *OutDataBlock;
OutDataBlock = 0i64;
v3 = EtwpAllocDataBlock(Reply->NotificationSize, Reply, &OutDataBlock);
if( v3 < 0 )
{
_InterlockedIncrement(&ReplyQueue->EventsLost);
}
else
{
PoolWithTag = (_LIST_ENTRY *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x38ui64, 0x72777445ui64);
if( PoolWithTag )
{
*PoolWithTag = 0i64;
PoolWithTag[1] = 0i64;
PoolWithTag[2] = 0i64;
PoolWithTag[3].Flink = 0i64;
PoolWithTag[1].Flink = (_LIST_ENTRY *)OutDataBlock;
KeInsertQueue(&ReplyQueue->Queue, PoolWithTag);
}
else
{
v3 = -1073741801;
_InterlockedIncrement(&ReplyQueue->EventsLost);
EtwpUnreferenceDataBlock((volatile INT32 *)OutDataBlock);
}
}
return(unsigned int)v3;
}Referenced by:
EtwpDeleteRegistrationObject
EtwpSendReplyDataBlock