EtwpApplyEventNameFilter

INT64 __fastcall EtwpApplyEventNameFilter(
        _ETW_GUID_ENTRY *GuidEntry,
        INT64 LoggerIndex,
        INT64 UserDataCount,
        _EVENT_DATA_DESCRIPTOR *UserData,
        INT64 UserMode,
        INT64 CurrentIrql,
        INT64 Level,
        UINT64 Keyword){
  INT64 result; 
  __int64 v9; 
  void **v11; 
  unsigned __int8 v12; 
  unsigned int v13; 
  _EVENT_DATA_DESCRIPTOR *v14; 
  unsigned int v15; 
  char *v16; 
  unsigned __int64 v17; 
  signed __int64 v18; 
  void *v19; 
  void *v20; 
  _ETW_FILTER_HEADER *FilterData; 
  __int64 v22; 
  _ETW_FILTER_EVENT_NAME_DATA *v23; 
  _ETW_FILTER_EVENT_NAME_DATA *StackWalkNameFilter; 
  _ETW_FILTER_HEADER *v25; 
  unsigned __int8 v26; 
  unsigned __int64 MatchAllKeyword; 
  bool v28; 
  bool v29; 
  char v30; 
  UINT16 NameLength; 
  PVOID P; 
  unsigned int v33; 
  void **v34; 
  void *Src[2]; 
  char v36; 
  v9 = (unsigned int)LoggerIndex;
  NameLength = 0;
  P = 0i64;
  *(_OWORD *)Src = 0i64;
  v11 = 0i64;
  v34 = 0i64;
  v12 = 0;
  v30 = 0;
  v29 = 1;
  if( (_BYTE)UserMode )
  {
    result = 16i64 * (unsigned int)UserDataCount;
    if( result )
    {
      if( ((unsigned __int8)UserData & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      if( (unsigned __int64)UserData + result > 0x7FFFFFFF0000i64
        || (_EVENT_DATA_DESCRIPTOR *)((char *)UserData + result) < UserData )
      {
        result = 0i64;
        MEMORY[0x7FFFFFFF0000] = 0;
      }
    }
  }
  v13 = 0;
  v33 = 0;
  while( v13 < (unsigned int)UserDataCount )
  {
    v14 = &UserData[v13];
    if( v14->Type == 1 )
    {
      if( (unsigned __int8)CurrentIrql >= 2u )
      {
        v11 = (void **)&UserData[v13];
        v34 = v11;
        result = v14->Ptr;
        P = (PVOID)v14->Ptr;
      }
      else
      {
        *(_EVENT_DATA_DESCRIPTOR *)Src = *v14;
        v11 = Src;
        v34 = Src;
        v15 = _mm_cvtsi128_si32(_mm_srli_si128(*(__m128i *)Src, 8));
        if( v15 >= 0xFFFF )
        {
          v29 = 0;
          goto LABEL_61;
        }
        if( (_BYTE)UserMode )
        {
          if( v15 )
          {
            v16 = (char *)Src[0] + v15;
            if( (unsigned __int64)v16 > 0x7FFFFFFF0000i64 || v16 < Src[0] )
            {
              MEMORY[0x7FFFFFFF0000] = 0;
              v15 = (unsigned int)Src[1];
            }
          }
        }
        if( v15 <= 0x100 )
        {
          v17 = v15 + 15i64;
          if( v17 <= v15 )
            v17 = 0xFFFFFFFFFFFFFF0i64;
          v18 = v17 & 0xFFFFFFFFFFFFFFF0ui64;
          v19 = alloca(v18);
          v20 = alloca(v18);
          P = &v29;
        }
        else
        {
          result = (INT64)ExAllocatePoolWithTag(NonPagedPoolNx, v15, 0x74777445ui64);
          P = (PVOID)result;
          if( !result )
          {
            v29 = 1;
            goto LABEL_61;
          }
          v30 = 1;
          v15 = (unsigned int)Src[1];
        }
        memmove((UINT8 *)P, (UINT8 *)Src[0], v15);
      }
      break;
    }
    v33 = ++v13;
  }
  if( !v11 || !P )
    goto LABEL_54;
  if( (unsigned __int8)CurrentIrql < 2u )
  {
    v12 = KeGetCurrentIrql();
    __writecr8(2ui64);
    result = (unsigned int)KiIrqlFlags;
  }
  FilterData = GuidEntry->FilterData;
  if( FilterData )
  {
    v22 = v9;
    v23 = v36 ? FilterData[v22].StackWalkNameFilter : FilterData[v22].EventNameFilter;
    if( v23 )
    {
      StackWalkNameFilter = 0i64;
      v25 = GuidEntry->FilterData;
      if( v25 )
      {
        if( v36 )
        {
          result = v25[v9].FilterFlags & 0x80002000;
          if( (_DWORD)result == -2147475456 )
            StackWalkNameFilter = v25[v22].StackWalkNameFilter;
        }
        else
        {
          result = v25[v9].FilterFlags & 0x80000400;
          if( (_DWORD)result == -2147482624 )
            StackWalkNameFilter = v25[v22].EventNameFilter;
        }
        if( StackWalkNameFilter )
        {
          v26 = StackWalkNameFilter->Level;
          if( (unsigned __int8)Level <= v26 || !v26 )
          {
            if( !Keyword
              || (Keyword & StackWalkNameFilter->MatchAnyKeyword) != 0
              && (MatchAllKeyword = StackWalkNameFilter->MatchAllKeyword,
                  result = Keyword & MatchAllKeyword,
                  (Keyword & MatchAllKeyword) == MatchAllKeyword) )
            {
              result = (INT64)EtwpGetEventNameFromEventMetadata((PSTR)P, *((unsigned int *)v34 + 2), &NameLength);
              if( !result )
              {
                if( (unsigned __int8)CurrentIrql < 2u )
                {
                  result = v12;
                  __writecr8(v12);
                }
LABEL_54:
                v29 = 1;
                goto LABEL_61;
              }
              if( NameLength )
                v28 = v23->FilterIn == (unsigned __int8)EtwpEventNameFilterSearch(
                                                          (const char *)result,
                                                          NameLength,
                                                          (__int64)v23);
              else
                v28 = v23->FilterIn == 0;
              v29 = v28;
            }
          }
        }
      }
    }
  }
  if( (unsigned __int8)CurrentIrql < 2u )
  {
    result = v12;
    __writecr8(v12);
  }
LABEL_61:
  if( v30 )
    ExFreePoolWithTag(P, 0);
  LOBYTE(result) = v29;
  return result;
}

Referenced by: