EtwpApplyPredicate

char __fastcall EtwpApplyPredicate(unsigned __int16 *a1, int a2, __int64 a3, __int64 a4, unsigned int Size, bool *a6){
  INT8 *v6; 
  char v9; 
  int v10; 
  int v11; 
  int v12; 
  int v13; 
  int v14; 
  __int64 v15; 
  bool v16; 
  bool v17; 
  unsigned int v18; 
  char *v19; 
  char *v20; 
  __int64 v21; 
  const WCHAR *v22; 
  char *j; 
  __int64 v24; 
  WCHAR v25; 
  INT8 *v26; 
  char *v27; 
  char *v28; 
  INT8 *v29; 
  INT8 *i; 
  unsigned int v31; 
  INT8 *v32; 
  INT8 v33; 
  unsigned __int64 v34; 
  unsigned __int64 v35; 
  UINT64 v36; 
  bool v37; 
  INT64 v38; 
  INT64 v39; 
  INT64 v41; 
  UINT64 OutputPtr; 
  INT8 *v43; 
  INT8 *v44; 
  const WCHAR *v45; 

  v6 = (INT8 *)a4;
  v41 = 0i64;
  OutputPtr = 0i64;
  if( !Size )
    return 0;
  v9 = 0;
  v10 = *(unsigned __int16 *)(a3 + 2);
  v11 = a2 - 1;
  if( !v11 )
  {
    if( !EtwpGetSignedFieldValue((UINT8 *)a4, Size, &v41) )
      return 0;
    v38 = *(_QWORD *)(a3 + 8);
    v39 = *(_QWORD *)(a3 + 16);
    if( !v10 )
    {
      v17 = v41 == v38;
      goto LABEL_119;
    }
    if( v10 != 1 )
    {
      switch( v10 )
      {
        case 2:
          v16 = v41 <= v38;
          goto LABEL_120;
        case 3:
          v16 = v41 > v38;
          goto LABEL_120;
        case 4:
          v16 = v41 < v38;
          goto LABEL_120;
        case 5:
          v16 = v41 >= v38;
          goto LABEL_120;
        case 6:
          if( v38 > v41 || v41 > v39 )
            goto LABEL_111;
          break;
        case 7:
          if( v41 >= v38 && v39 >= v41 )
            goto LABEL_111;
          break;
        default:
          if( v10 != 8 || !v38 )
            return 0;
          v36 = v41 % v38;
          goto LABEL_81;
      }
LABEL_108:
      v16 = 1;
      goto LABEL_120;
    }
    v37 = v41 == v38;
LABEL_117:
    v16 = !v37;
    goto LABEL_120;
  }
  v12 = v11 - 1;
  if( !v12 )
  {
    if( !EtwpGetFieldValue((UINT8 *)a4, Size, &OutputPtr) )
      return 0;
    if( !v10 )
    {
      v17 = OutputPtr == *(_QWORD *)(a3 + 8);
      goto LABEL_119;
    }
    if( v10 != 1 )
    {
      switch( v10 )
      {
        case 2:
          v16 = OutputPtr <= *(_QWORD *)(a3 + 8);
          goto LABEL_120;
        case 3:
          v16 = OutputPtr > *(_QWORD *)(a3 + 8);
          goto LABEL_120;
        case 4:
          v16 = OutputPtr < *(_QWORD *)(a3 + 8);
          goto LABEL_120;
        case 5:
          v16 = OutputPtr >= *(_QWORD *)(a3 + 8);
          goto LABEL_120;
        case 6:
          if( *(_QWORD *)(a3 + 8) > OutputPtr || OutputPtr > *(_QWORD *)(a3 + 16) )
            goto LABEL_111;
          break;
        case 7:
          if( OutputPtr >= *(_QWORD *)(a3 + 8) && *(_QWORD *)(a3 + 16) >= OutputPtr )
            goto LABEL_111;
          break;
        case 8:
          v35 = *(_QWORD *)(a3 + 8);
          if( !v35 )
            return 0;
          v36 = OutputPtr % v35;
LABEL_81:
          v17 = v36 == 0;
          goto LABEL_119;
        default:
          return 0;
      }
      goto LABEL_108;
    }
    v37 = OutputPtr == *(_QWORD *)(a3 + 8);
    goto LABEL_117;
  }
  v13 = v12 - 1;
  if( !v13 )
  {
    v27 = (char *)a1 + a1[24];
    v28 = &v27[a1[25]];
    v29 = &v27[*(_QWORD *)(a3 + 8)];
    if( v29 >= v28 )
      return 0;
    for( i = v29; *i && i < v28; ++i )
      ;
    v31 = (_DWORD)i - (_DWORD)v29;
    if( v31 )
    {
      if( v10 != 20 )
      {
        if( v10 != 21 )
        {
          if( v10 != 30 )
          {
            if( v10 != 31 )
              return 0;
            v9 = 1;
          }
          v16 = v9;
          if( v31 == Size )
          {
            v16 = 1;
            while( 1 )
            {
              v32 = v29;
              if( !v31 )
                break;
              if( *v6 != *v29 )
              {
                v16 = 0;
                break;
              }
              v44 = ++v6;
              ++v29;
              OutputPtr = (UINT64)(v32 + 1);
              --v31;
            }
LABEL_30:
            if( v9 )
            {
LABEL_12:
              v17 = !v16;
LABEL_119:
              v16 = v17;
            }
          }
LABEL_120:
          *a6 = v16;
          return 1;
        }
        v9 = 1;
      }
      v16 = v9;
      if( v31 > Size )
        goto LABEL_120;
      v33 = *v29;
      v34 = Size - (unsigned __int64)v31 + a4 + 1;
      v16 = 0;
      while( (unsigned __int64)v6 < v34 )
      {
        if( *v6 == v33 && !strncmp(v6, v29, v31) )
        {
          v16 = 1;
          goto LABEL_30;
        }
        v44 = ++v6;
      }
      goto LABEL_30;
    }
LABEL_111:
    v16 = 0;
    goto LABEL_120;
  }
  v14 = v13 - 1;
  if( !v14 )
  {
    if( (Size & 1) != 0 )
      return 0;
    v18 = Size >> 1;
    v19 = (char *)a1 + a1[22];
    v20 = &v19[2 * ((unsigned __int64)a1[23] >> 1)];
    v21 = *(_QWORD *)(a3 + 8);
    v22 = (const WCHAR *)&v19[2 * v21];
    if( v22 >= (const WCHAR *)v20 )
      return 0;
    for( j = &v19[2 * v21]; *(_WORD *)j && j < v20; j += 2 )
      ;
    v24 = (j - (char *)v22) >> 1;
    if( (_DWORD)v24 )
    {
      if( v10 != 20 )
      {
        if( v10 != 21 )
        {
          if( v10 != 30 )
          {
            if( v10 != 31 )
              return 0;
            v9 = 1;
          }
          v16 = v9;
          if( (_DWORD)v24 == v18 )
          {
            v16 = 1;
            while( (_DWORD)v24 )
            {
              if( *v22 != *(_WORD *)v6 )
              {
                v16 = 0;
                goto LABEL_30;
              }
              v6 += 2;
              v43 = v6;
              v45 = ++v22;
              LODWORD(v24) = v24 - 1;
            }
            goto LABEL_30;
          }
          goto LABEL_120;
        }
        v9 = 1;
      }
      v16 = v9;
      if( (unsigned int)v24 > v18 )
        goto LABEL_120;
      v25 = *v22;
      v26 = &v6[2 * (v18 - (unsigned __int64)(unsigned int)v24) + 2];
      v16 = 0;
      while( v6 < v26 )
      {
        if( *(_WORD *)v6 == v25 && !wcsncmp((const WCHAR *)v6, v22, v24) )
        {
          v16 = 1;
          goto LABEL_30;
        }
        v6 += 2;
        v43 = v6;
      }
      goto LABEL_30;
    }
    goto LABEL_111;
  }
  if( v14 == 1 && Size == 16 )
  {
    v15 = *(_QWORD *)a4 - *(_QWORD *)(a3 + 8);
    if( *(_QWORD *)a4 == *(_QWORD *)(a3 + 8) )
      v15 = *(_QWORD *)(a4 + 8) - *(_QWORD *)(a3 + 16);
    v16 = v15 == 0;
    if( v10 == 30 )
      goto LABEL_120;
    if( v10 == 31 )
      goto LABEL_12;
  }
  return 0;
}

Referenced by: