EtwpApplyEventIdPayloadFilter

CHAR __fastcall EtwpApplyEventIdPayloadFilter(
        INT64 a1,
        UINT64 a2,
        INT16 a3,
        INT64 a4,
        INT16 a5,
        UINT64 DataSegCount,
        UINT64 DataSegsIn,
        CHAR a8,
        UINT8 a9){
  __int64 v9; 
  INT64 v12; 
  unsigned __int8 CurrentIrql; 
  __int64 v14; 
  INT64 v15; 
  CHAR v16; 
  _BYTE *v17; 
  __int64 v19; 
  INT64 v20; 
  CHAR v21; 
  _BYTE *v22; 
  int v23; 
  CHAR v24; 
  char WriteEventPtr[24]; 
  v9 = 0i64;
  WriteEventPtr[0] = 1;
  v12 = a1;
  if( a9 >= 2u )
  {
    v19 = 104i64 * (unsigned int)a2;
    v20 = *(_QWORD *)(*(_QWORD *)(a1 + 384) + v19 + 72);
    if( v20 )
    {
      v21 = EtwpPerfectHashFunctionSearch(a5, v20);
      if( *v22 != v21 )
        return 0;
    }
    v9 = *(_QWORD *)(*(_QWORD *)(v12 + 384) + v19 + 80);
  }
  else
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    v14 = 104i64 * (unsigned int)a2;
    v15 = *(_QWORD *)(*(_QWORD *)(a1 + 384) + v14 + 72);
    if( !v15 || (v16 = EtwpPerfectHashFunctionSearch(a5, v15), *v17 == v16) )
    {
      v9 = *(_QWORD *)(*(_QWORD *)(v12 + 384) + v14 + 80);
      if( v9 )
        _InterlockedIncrement((volatile signed __int32 *)v9);
    }
    else
    {
      WriteEventPtr[0] = 0;
    }
    __writecr8(CurrentIrql);
  }
  if( !v9 )
    return WriteEventPtr[0];
  v23 = EtwpApplyPayloadFilterInternal(
          (const _EVENT_DESCRIPTOR *)a4,
          (unsigned int)DataSegCount,
          (_EVENT_DATA_DESCRIPTOR *)DataSegsIn,
          (unsigned __int8)a8,
          a3 == 0,
          (_AGGREGATED_PAYLOAD_FILTER *)(v9 + 8),
          (UINT8 *)WriteEventPtr);
  v24 = WriteEventPtr[0];
  if( v23 < 0 )
    v24 = 1;
  WriteEventPtr[0] = v24;
  if( a9 < 2u )
  {
    if( _InterlockedExchangeAdd((volatile signed __int32 *)v9, 0xFFFFFFFF) == 1 )
      ExFreePoolWithTag((PVOID)v9, 0);
    return WriteEventPtr[0];
  }
  return v24;
}

Referenced by: