BapdpParseEventParts
VOID __stdcall BapdpParseEventParts(
EVENT_DESCRIPTOR *EventDescriptor,
UINT8 *EventData,
UINT64 DataSize,
EVENT_DATA_DESCRIPTOR *DataDescriptor,
UINT64 *DataDesciptorCount){
int v5;
__int64 v6;
UINT8 *v7;
__int64 v8;
if( EventDescriptor->Channel == 11
&& (unsigned int)DataSize >= 7
&& (v6 = *(unsigned __int16 *)EventData, v5 = 3, (unsigned int)v6 >= 3)
&& (unsigned int)v6 <= (int)DataSize - 4
&& (v7 = &EventData[v6], v8 = *(unsigned __int16 *)&EventData[v6], (unsigned int)v8 >= 4)
&& (unsigned int)v8 <= (int)DataSize - (int)v6 )
{
DataDescriptor->Reserved = 0;
DataDescriptor[1].Reserved = 0;
DataDescriptor[2].Reserved = 0;
DataDescriptor[2].Ptr = (unsigned __int64)&v7[v8];
DataDescriptor[2].Size = DataSize - v6 - v8;
DataDescriptor->Size = v6;
DataDescriptor->Type = 2;
DataDescriptor[1].Ptr = (unsigned __int64)v7;
DataDescriptor[1].Size = v8;
DataDescriptor[1].Type = 1;
}
else
{
DataDescriptor->Reserved = 0;
v5 = 1;
DataDescriptor->Size = DataSize;
}
DataDescriptor->Ptr = (unsigned __int64)EventData;
*(_DWORD *)DataDesciptorCount = v5;
}Referenced by:
BapdWriteEtwEvents