EtwpGetSignedFieldValue
UINT8 __stdcall EtwpGetSignedFieldValue(UINT8 *DataSegPtr, UINT64 Size, INT64 *OutputPtr){
UINT8 v3;
int v4;
int v5;
int v6;
INT64 v7;
v3 = 1;
v4 = Size - 1;
if( !v4 )
{
v7 = (char)*DataSegPtr;
goto LABEL_10;
}
v5 = v4 - 1;
if( !v5 )
{
v7 = *(__int16 *)DataSegPtr;
goto LABEL_10;
}
v6 = v5 - 2;
if( !v6 )
{
v7 = *(int *)DataSegPtr;
goto LABEL_10;
}
if( v6 == 4 )
{
v7 = *(_QWORD *)DataSegPtr;
LABEL_10:
*OutputPtr = v7;
return v3;
}
return 0;
}Referenced by:
EtwpApplyPredicate