EtwpGetFieldValue
UINT8 __stdcall EtwpGetFieldValue(UINT8 *DataSegPtr, UINT64 Size, UINT64 *OutputPtr){
UINT8 v3;
int v4;
int v5;
int v6;
UINT64 v7;
v3 = 1;
v4 = Size - 1;
if( !v4 )
{
v7 = *DataSegPtr;
goto LABEL_10;
}
v5 = v4 - 1;
if( !v5 )
{
v7 = *(unsigned __int16 *)DataSegPtr;
goto LABEL_10;
}
v6 = v5 - 2;
if( !v6 )
{
v7 = *(unsigned int *)DataSegPtr;
goto LABEL_10;
}
if( v6 == 4 )
{
v7 = *(_QWORD *)DataSegPtr;
LABEL_10:
*OutputPtr = v7;
return v3;
}
return 0;
}Referenced by:
EtwpApplyPayloadFilterInternal
EtwpApplyPredicate