EtwpConstructIptData

NTSTATUS __stdcall EtwpConstructIptData(INT64 a1){
  UINT64 *v1; 
  UINT64 v2; 
  UINT8 *v3; 
  NTSTATUS Driver; 
  VOID **PoolWithTag; 
  VOID *ExtensionTable; 
  UINT64 v9; 

  Driver = ZwLoadDriver(aNp_0, v1, v2, v3, v9);
  if( (int)(Driver + 0x80000000) >= 0 && Driver != -1073741554 )
    return -1073741204;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x28ui64, 1769436229i64);
  if( !PoolWithTag )
    return -1073741801;
  *(_OWORD *)PoolWithTag = 0i64;
  *((_OWORD *)PoolWithTag + 1) = 0i64;
  PoolWithTag[4] = 0i64;
  ExtensionTable = ExGetExtensionTable(*(&ExBootDevicesRemovedEvent + 147));
  PoolWithTag[2] = ExtensionTable;
  if( !ExtensionTable )
  {
    ExFreePoolWithTag(PoolWithTag, 0);
    return -1073741204;
  }
  *(_QWORD *)(a1 + 1016) = PoolWithTag;
  return 0;
}

Referenced by: