EtwpBuildNotificationPacket

NTSTATUS __stdcall EtwpBuildNotificationPacket(
        _ETW_GUID_ENTRY *GuidEntry,
        _ETW_ENABLE_NOTIFICATION_PACKET *EnableNotification,
        UINT8 EnableMask,
        _ETWP_NOTIFICATION_HEADER **NotificationPacket){
  int SchematizedFilterSize; 
  int v9; 
  int v10; 
  _ETWP_NOTIFICATION_HEADER *v12; 
  unsigned int v13; 
  _ETWP_NOTIFICATION_HEADER *v14; 
  _ETWP_NOTIFICATION_HEADER *OutDataBlock[5]; 

  OutDataBlock[0] = 0i64;
  SchematizedFilterSize = EtwpGetSchematizedFilterSize(GuidEntry, EnableMask);
  v9 = SchematizedFilterSize;
  if( SchematizedFilterSize )
  {
    v13 = SchematizedFilterSize + 136;
    v10 = EtwpAllocDataBlock((unsigned int)(SchematizedFilterSize + 136), 0i64, OutDataBlock);
    if( v10 >= 0 )
    {
      v14 = OutDataBlock[0];
      if( EnableNotification )
      {
        *(_OWORD *)OutDataBlock[0] = *(_OWORD *)EnableNotification->gap0;
        *(_OWORD *)&v14->ReplyIndex = *(_OWORD *)&EnableNotification->gap0[16];
        *(_OWORD *)&v14->TargetPID = *(_OWORD *)&EnableNotification->gap0[32];
        *(_OWORD *)v14->DestinationGuid.Data4 = *(_OWORD *)&EnableNotification->gap0[48];
        *(_OWORD *)v14->SourceGuid[0].Data4 = *(_OWORD *)&EnableNotification->gap0[64];
        *(_OWORD *)v14->SourceGuid[1].Data4 = *(_OWORD *)&EnableNotification->EnableInfo.EnableProperty;
        *(_OWORD *)v14->SourceGuid[2].Data4 = *(_OWORD *)&EnableNotification->EnableInfo.MatchAllKeyword;
        *(_QWORD *)v14->SourceGuid[3].Data4 = *(_QWORD *)&EnableNotification->LegacyProviderEnabled;
      }
      *(_DWORD *)&v14->SourceGuid[3].Data4[4] = 1;
      v14->RefCount = 1;
      v14->NotificationSize = v13;
      *NotificationPacket = v14;
      *(_QWORD *)&v14->SourceGuid[4].Data1 = 136i64;
      *(_DWORD *)&v14->SourceGuid[4].Data4[4] = 0x80000000;
      *(_DWORD *)v14->SourceGuid[4].Data4 = v9;
      EtwpCopySchematizedFilters(&v14->SourceGuid[5], (__int64)GuidEntry, EnableMask);
    }
  }
  else if( EnableNotification )
  {
    return EtwpAllocDataBlock(
             *(unsigned int *)&EnableNotification->gap0[4],
             (_ETWP_NOTIFICATION_HEADER *)EnableNotification,
             NotificationPacket);
  }
  else
  {
    v10 = EtwpAllocDataBlock(0x78ui64, 0i64, OutDataBlock);
    if( v10 >= 0 )
    {
      v12 = OutDataBlock[0];
      *NotificationPacket = OutDataBlock[0];
      v12->RefCount = 1;
      v12->NotificationSize = 120;
    }
  }
  return v10;
}

Referenced by: