EtwpInitializeCompressedWriter

NTSTATUS __stdcall EtwpInitializeCompressedWriter(INT64 a1, INT64 a2, INT64 a3){
  NTSTATUS v3; 
  int v5; 
  VOID **PoolWithTag; 
  size_t v8; 
  VOID **v9; 
  UINT64 NumberOfBytes; 
  UINT64 v12; 

  v3 = 0;
  v5 = a2;
  LODWORD(v12) = 0;
  LODWORD(NumberOfBytes) = 0;
  RtlGetCompressionWorkSpaceSize(3u, &NumberOfBytes, &v12);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1517777989i64);
  *(_QWORD *)(a1 + 32) = PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  *(_DWORD *)(a1 + 16) = v5;
  *(_DWORD *)(a1 + 48) = 2 * v5;
  v8 = 2 * v5;
  v9 = ExAllocatePoolWithTag(1ui64, v8, 1517777989i64);
  *(_QWORD *)(a1 + 40) = v9;
  if( !v9 )
    return -1073741801;
  memset(v9, 0i64, v8);
  *(_QWORD *)a1 = a3;
  return v3;
}

Referenced by: