EtwpAllocDataBlock

NTSTATUS __stdcall EtwpAllocDataBlock(
        UINT64 DataBlockSize,
        _ETWP_NOTIFICATION_HEADER *InDataBlock,
        _ETWP_NOTIFICATION_HEADER **OutDataBlock){
  NTSTATUS v3; 
  size_t v6; 
  VOID **PoolWithTag; 
  _ETWP_NOTIFICATION_HEADER *v8; 

  v3 = 0;
  *OutDataBlock = 0i64;
  if( InDataBlock && InDataBlock->NotificationSize != (_DWORD)DataBlockSize )
    return -1073741820;
  v6 = DataBlockSize;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)DataBlockSize, 1148679237i64);
  v8 = (_ETWP_NOTIFICATION_HEADER *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  if( InDataBlock )
    memmove(PoolWithTag, InDataBlock, v6);
  else
    memset(PoolWithTag, 0i64, v6);
  v8->RefCount = 1;
  *OutDataBlock = v8;
  return v3;
}

Referenced by: