EtwpUpdatePidFilterData

__int64 __fastcall EtwpUpdatePidFilterData(__int64 a1, __int64 a2, char a3){
  unsigned int v3; 
  unsigned int v6; 
  VOID **PoolWithTag; 

  v3 = 0;
  if( a3 )
  {
    ExFreePoolWithTag(*(PVOID *)(a1 + 8), 0);
    *(_QWORD *)(a1 + 8) = 0i64;
  }
  else
  {
    v6 = *(_DWORD *)(a2 + 8) >> 2;
    if( v6 <= 8 )
    {
      PoolWithTag = *(VOID ***)(a1 + 8);
      if( !PoolWithTag )
      {
        PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x24ui64, 1182233669i64);
        if( !PoolWithTag )
          return(unsigned int)-1073741801;
        *(_QWORD *)(a1 + 8) = PoolWithTag;
      }
      *(_DWORD *)PoolWithTag = v6;
      memmove((char *)PoolWithTag + 4, *(const VOID **)a2, 4 * v6);
      return v3;
    }
    return(unsigned int)-1073741811;
  }
  return v3;
}

Referenced by: