EtwpValidateFlagExtension

NTSTATUS __stdcall EtwpValidateFlagExtension(_WMI_LOGGER_INFORMATION *LoggerInfo){
  int v1; 
  unsigned __int64 v3; 
  unsigned __int16 *v4; 
  unsigned __int16 v5; 
  unsigned __int16 *v6; 
  unsigned __int16 v7; 
  __int16 v8; 
  __int64 v9; 

  v1 = LoggerInfo[18];
  if( v1 >= 0 )
    return 0;
  if( BYTE2(v1) != 0xFF )
    return -1073741811;
  if( !(_WORD)v1 )
    return -1073741811;
  v3 = (unsigned int)*LoggerInfo;
  if( v3 < (unsigned __int64)(unsigned __int16)v1 + 4 )
    return -1073741811;
  v4 = (unsigned __int16 *)((char *)LoggerInfo + (unsigned __int16)v1);
  if( (((_BYTE)v1 + (_BYTE)LoggerInfo) & 1) == 0 )
  {
    if( *v4 && 4 * (unsigned __int64)*v4 <= (unsigned int)v3 - (unsigned __int16)v1 )
    {
      v5 = v4[1];
      v6 = v4 + 2;
      v7 = *v4 - 1;
      v8 = 0;
      if( v5 )
      {
        while( ((unsigned __int8)v6 & 1) == 0 )
        {
          if( !v7 )
            return -1073741811;
          v9 = *v6;
          if( v7 < (unsigned __int16)v9 )
            return -1073741811;
          v7 -= v9;
          v6 += 2 * v9;
          if( (unsigned __int16)++v8 >= v5 )
            goto LABEL_14;
        }
        return -1073741115;
      }
LABEL_14:
      if( !v7 )
        return 0;
    }
    return -1073741811;
  }
  return -1073741115;
}

Referenced by: