EtwpApplyExeFilter

UINT8 __stdcall EtwpApplyExeFilter(_ETW_REG_ENTRY *RegEntry, _ETW_FILTER_STRING_TOKEN *TokenList){
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  unsigned int v5; 
  const wchar_t *v6; 
  unsigned int v7; 
  const wchar_t *v8; 
  const wchar_t *v9; 
  unsigned __int16 v10; 
  size_t v11; 
  UINT8 v12; 

  ImageFileName = RegEntry->Process->SeAuditProcessCreationInfo.ImageFileName;
  if( !ImageFileName )
    return 1;
  v5 = *(_WORD *)ImageFileName;
  v6 = (const wchar_t *)*((_QWORD *)ImageFileName + 1);
  v7 = v5 >> 1;
  v8 = &v6[v7];
  while( v8 != v6 )
  {
    v9 = v8--;
    if( *v8 == 92 )
    {
      v8 = v9;
      break;
    }
  }
  v10 = 0;
  v11 = v7 - (v8 - v6);
  if( !TokenList->Count )
    return 0;
  v12 = 1;
  while( TokenList->Tokens[v10].Length != v11 || wcsnicmp(TokenList->Tokens[v10].String, v8, v11) )
  {
    if( ++v10 >= TokenList->Count )
      return 0;
  }
  return v12;
}

Referenced by: