EtwpApplyEventIdPayloadFilter

char __fastcall EtwpApplyEventIdPayloadFilter(
        __int64 a1,
        unsigned int a2,
        __int16 a3,
        __int64 a4,
        __int16 a5,
        unsigned int a6,
        unsigned __int64 a7,
        char a8,
        unsigned __int8 a9){
  volatile signed __int32 *v9; 
  __int64 v12; 
  unsigned __int8 CurrentIrql; 
  __int64 v14; 
  _BYTE *v15; 
  char v16; 
  __int64 v18; 
  _BYTE *v19; 
  char v20; 
  int v21; 
  char v22; 
  char v23[24]; 

  v9 = 0i64;
  v23[0] = 1;
  v12 = a1;
  if( a9 >= 2u )
  {
    v18 = 104i64 * a2;
    if( *(_QWORD *)(*(_QWORD *)(a1 + 384) + v18 + 72) )
    {
      EtwpPerfectHashFunctionSearch();
      if( *v19 != v20 )
        return 0;
    }
    v9 = *(volatile signed __int32 **)(*(_QWORD *)(v12 + 384) + v18 + 80);
  }
  else
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    v14 = 104i64 * a2;
    if( !*(_QWORD *)(*(_QWORD *)(a1 + 384) + v14 + 72) || (EtwpPerfectHashFunctionSearch(), *v15 == v16) )
    {
      v9 = *(volatile signed __int32 **)(*(_QWORD *)(v12 + 384) + v14 + 80);
      if( v9 )
        _InterlockedIncrement(v9);
    }
    else
    {
      v23[0] = 0;
    }
    __writecr8(CurrentIrql);
  }
  if( !v9 )
    return v23[0];
  v21 = EtwpApplyPayloadFilterInternal(a4, a6, a7, a8, a3 == 0, (__int64)(v9 + 2), v23);
  v22 = v23[0];
  if( v21 < 0 )
    v22 = 1;
  v23[0] = v22;
  if( a9 < 2u )
  {
    if( _InterlockedExchangeAdd(v9, 0xFFFFFFFF) == 1 )
      ExFreePoolWithTag((PVOID)v9, 0);
    return v23[0];
  }
  return v22;
}

Referenced by: