EtwpApplyEventNameFilter

char __fastcall EtwpApplyEventNameFilter(
        __int64 a1,
        unsigned int a2,
        unsigned int a3,
        unsigned __int64 a4,
        char a5,
        unsigned __int8 a6,
        unsigned __int8 a7,
        __int64 a8,
        char a9){
  __int64 v9; 
  VOID **v11; 
  unsigned __int8 CurrentIrql; 
  __int64 v13; 
  unsigned int v14; 
  unsigned __int64 v15; 
  size_t v16; 
  char *v17; 
  unsigned __int64 v18; 
  signed __int64 v19; 
  void *v20; 
  void *v21; 
  __int64 v22; 
  __int64 v23; 
  _BYTE *v24; 
  __int64 v25; 
  __int64 v26; 
  unsigned __int8 v27; 
  UINT8 *EventNameFromEventMetadata; 
  bool v29; 
  bool v31; 
  char v32; 
  UINT16 NameLength; 
  PSTR UserDataBlob; 
  unsigned int v35; 
  VOID **v36; 
  VOID *Src[2]; 

  v9 = a2;
  NameLength = 0;
  UserDataBlob = 0i64;
  *(_OWORD *)Src = 0i64;
  v11 = 0i64;
  v36 = 0i64;
  CurrentIrql = 0;
  v32 = 0;
  v31 = 1;
  if( a5 )
  {
    v13 = 16i64 * a3;
    if( v13 )
    {
      if( (a4 & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      if( v13 + a4 > 0x7FFFFFFF0000i64 || v13 + a4 < a4 )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  v14 = 0;
  v35 = 0;
  while( v14 < a3 )
  {
    v15 = a4 + 16i64 * v14;
    if( *(_BYTE *)(v15 + 12) == 1 )
    {
      if( a6 >= 2u )
      {
        v11 = (VOID **)(a4 + 16i64 * v14);
        v36 = v11;
        UserDataBlob = *(PSTR *)v15;
      }
      else
      {
        *(_OWORD *)Src = *(_OWORD *)v15;
        v11 = Src;
        v36 = Src;
        v16 = _mm_cvtsi128_si32(_mm_srli_si128(*(__m128i *)Src, 8));
        if( v16 >= 0xFFFF )
        {
          v31 = 0;
          goto LABEL_61;
        }
        if( a5 )
        {
          if( v16 )
          {
            v17 = (char *)Src[0] + v16;
            if( (unsigned __int64)v17 > 0x7FFFFFFF0000i64 || v17 < Src[0] )
            {
              MEMORY[0x7FFFFFFF0000] = 0;
              v16 = (size_t)Src[1];
            }
          }
        }
        if( v16 <= 0x100 )
        {
          v18 = v16 + 15i64;
          if( v18 <= v16 )
            v18 = 0xFFFFFFFFFFFFFF0i64;
          v19 = v18 & 0xFFFFFFFFFFFFFFF0ui64;
          v20 = alloca(v19);
          v21 = alloca(v19);
          UserDataBlob = (PSTR)&v31;
        }
        else
        {
          UserDataBlob = (PSTR)ExAllocatePoolWithTag(0x200ui64, v16, 1953985605i64);
          if( !UserDataBlob )
          {
            v31 = 1;
            goto LABEL_61;
          }
          v32 = 1;
          v16 = (size_t)Src[1];
        }
        memmove(UserDataBlob, Src[0], v16);
      }
      break;
    }
    v35 = ++v14;
  }
  if( !v11 || !UserDataBlob )
    goto LABEL_54;
  if( a6 < 2u )
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
  }
  v22 = *(_QWORD *)(a1 + 384);
  if( v22 )
  {
    v23 = 104 * v9;
    v24 = a9 ? *(_BYTE **)(v22 + v23 + 56) : *(_BYTE **)(v22 + v23 + 96);
    if( v24 )
    {
      v25 = 0i64;
      v26 = *(_QWORD *)(a1 + 384);
      if( v26 )
      {
        if( a9 )
        {
          if( (*(_DWORD *)(v26 + 104 * v9) & 0x80002000) == -2147475456 )
            v25 = *(_QWORD *)(v26 + v23 + 56);
        }
        else if( (*(_DWORD *)(v26 + 104 * v9) & 0x80000400) == -2147482624 )
        {
          v25 = *(_QWORD *)(v26 + v23 + 96);
        }
        if( v25 )
        {
          v27 = *(_BYTE *)(v25 + 1);
          if( (a7 <= v27 || !v27)
            && (!a8 || (a8 & *(_QWORD *)(v25 + 8)) != 0 && (a8 & *(_QWORD *)(v25 + 16)) == *(_QWORD *)(v25 + 16)) )
          {
            EventNameFromEventMetadata = (UINT8 *)EtwpGetEventNameFromEventMetadata(
                                                    UserDataBlob,
                                                    *((unsigned int *)v36 + 2),
                                                    &NameLength);
            if( !EventNameFromEventMetadata )
            {
              if( a6 < 2u )
                __writecr8(CurrentIrql);
LABEL_54:
              v31 = 1;
              goto LABEL_61;
            }
            if( NameLength )
              v29 = *v24 == EtwpEventNameFilterSearch(EventNameFromEventMetadata, NameLength, (INT64)v24);
            else
              v29 = *v24 == 0;
            v31 = v29;
          }
        }
      }
    }
  }
  if( a6 < 2u )
    __writecr8(CurrentIrql);
LABEL_61:
  if( v32 )
    ExFreePoolWithTag(UserDataBlob, 0);
  return v31;
}

Referenced by: