EtwpAllocatePayloadFilterData

NTSTATUS __stdcall EtwpAllocatePayloadFilterData(
        GUID *ProviderGuid,
        EVENT_FILTER_DESCRIPTOR *FilterData,
        _ETW_PAYLOAD_FILTER **PayloadFilter){
  unsigned int Size; 
  NTSTATUS result; 
  NTSTATUS v7; 
  VOID *PoolWithTag; 
  _ETW_PAYLOAD_FILTER *v9; 
  UINT64 v10; 
  UINT8 *Ptr; 
  Size = FilterData->Size;
  result = EtwpValidatePayloadFilter(ProviderGuid, (_AGGREGATED_PAYLOAD_FILTER *)FilterData->Ptr, Size);
  v7 = result;
  if( result >= 0 )
  {
    PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, Size + 8, 0x46777445ui64);
    v9 = (_ETW_PAYLOAD_FILTER *)PoolWithTag;
    if( PoolWithTag )
    {
      v10 = FilterData->Size;
      Ptr = (UINT8 *)FilterData->Ptr;
      *(_DWORD *)PoolWithTag = 1;
      memmove((UINT8 *)PoolWithTag + 8, Ptr, v10);
      result = v7;
      *PayloadFilter = v9;
    }
    else
    {
      return -1073741801;
    }
  }
  return result;
}

Referenced by: