EtwpApplyTransientFilters

CHAR __fastcall EtwpApplyTransientFilters(_ETW_REG_ENTRY *RegEntry, INT64 a2, INT64 a3, _ETW_FILTER_STRING_TOKEN **a4){
  CHAR v4; 
  unsigned int v9; 
  _ETW_FILTER_STRING_TOKEN *v10; 
  _DWORD *v12; 
  unsigned int v13; 

  v4 = 1;
  if( (RegEntry->Flags & 1) == 0 )
  {
    v9 = 0;
    if( !*a4 || (v4 = EtwpApplyExeFilter(RegEntry, *a4)) != 0 )
    {
      v10 = a4[1];
      if( v10 || a4[2] )
        v4 = EtwpApplyPackageIdFilter(RegEntry, v10, a4[2]);
      if( v4 )
      {
        if( a3 )
        {
          v4 = 0;
          v12 = (_DWORD *)(a2 + *(_QWORD *)a3);
          v13 = *(_DWORD *)(a3 + 8) >> 2;
          if( v13 )
          {
            while( *v12 != LODWORD(RegEntry->Process->UniqueProcessId) )
            {
              ++v9;
              ++v12;
              if( v9 >= v13 )
                return v4;
            }
            return 1;
          }
        }
      }
    }
  }
  return v4;
}

Referenced by: