EtwpValidateFilterDescriptors

NTSTATUS __stdcall EtwpValidateFilterDescriptors(
        _ETW_ENABLE_NOTIFICATION_PACKET *EnableNotificationPacket,
        _ETW_FILTER_INFO *FilterInfo){
  unsigned int FilterCount; 
  unsigned int v5; 
  unsigned int v6; 
  int v7; 
  int v8; 
  char *v9; 
  unsigned __int64 v10; 
  unsigned int EnableProperty; 
  int v12; 
  int v13; 
  NTSTATUS result; 
  __int64 v15; 
  __int128 v16; 

  v16 = 0i64;
  FilterCount = EnableNotificationPacket->FilterCount;
  if( FilterCount > 0xD )
    return -1073741811;
  v5 = *(_DWORD *)&EnableNotificationPacket->gap0[4];
  v6 = 16 * FilterCount + 120;
  if( v6 > v5 )
    return -1073741811;
  v7 = 0;
  v8 = 0;
  if( FilterCount )
  {
    while( 1 )
    {
      v9 = &EnableNotificationPacket[1].gap0[16 * v8];
      v10 = *(_QWORD *)v9;
      if( *(_QWORD *)v9 < (unsigned __int64)v6 )
        return -1073741811;
      EnableProperty = EnableNotificationPacket->EnableInfo.EnableProperty;
      if( (EnableProperty & 0x20) != 0 )
      {
        v12 = *((_DWORD *)v9 + 3);
        if( v12 == -2147479552
          || v12 == -2147483136
          || v12 == -2147482624
          || v12 == -2147475456
          || v12 == -2147483392
          || v12 == 0x80000000
          || v12 == -2147483646 )
        {
          return -1073741811;
        }
      }
      v13 = *((_DWORD *)v9 + 3);
      if( (EnableProperty & 0x400) != 0 )
      {
        if( ((v13 + 0x80000000) & 0xFFFFFEFD) == 0 && v13 != -2147483390 )
          return -1073741811;
      }
      else if( v13 == -2147450880 )
      {
        return -1073741811;
      }
      v15 = *((unsigned int *)v9 + 2);
      if( (unsigned int)v15 > 0x400 )
      {
        if( v13 == -2147483392 )
          goto LABEL_23;
        if( v13 != -2147482624 )
          return -1073741811;
      }
      if( v13 == -2147483392 )
      {
LABEL_23:
        if( (unsigned int)v15 > 0x1000 )
          return -1073741811;
      }
      if( (v13 == -2147482624 || v13 == -2147475456) && (unsigned int)v15 > 0x1000
        || v10 + v15 < v10
        || v10 + v15 > *(unsigned int *)&EnableNotificationPacket->gap0[4] )
      {
        return -1073741811;
      }
      v7 += v15;
      if( v13 == -2147483644 )
      {
        *((_QWORD *)FilterInfo + 10) = v9;
      }
      else if( v13 == -2147467264 )
      {
        *((_QWORD *)FilterInfo + 8) = v9;
      }
      else
      {
        *((_QWORD *)&v16 + 1) = __PAIR64__(v13, v15);
        *(_QWORD *)&v16 = (char *)EnableNotificationPacket + v10;
        result = EtwpAllocateFilter(v13, &v16, FilterInfo, (const _GUID *)&EnableNotificationPacket->gap0[40]);
        if( result < 0 )
          return result;
      }
      if( ++v8 >= EnableNotificationPacket->FilterCount )
      {
        v5 = *(_DWORD *)&EnableNotificationPacket->gap0[4];
        break;
      }
    }
  }
  if( v6 + v7 == v5 )
    return 0;
  else
    return -1073741811;
}

Referenced by: