BapdpParseEventParts

VOID __stdcall BapdpParseEventParts(
        EVENT_DESCRIPTOR *EventDescriptor,
        UINT8 *EventData,
        UINT64 DataSize,
        EVENT_DATA_DESCRIPTOR *DataDescriptor,
        UINT64 *DataDesciptorCount){
  int v5; 
  __int64 v6; 
  UINT8 *v7; 
  __int64 v8; 
  if( EventDescriptor->Channel == 11
    && (unsigned int)DataSize >= 7
    && (v6 = *(unsigned __int16 *)EventData, v5 = 3, (unsigned int)v6 >= 3)
    && (unsigned int)v6 <= (int)DataSize - 4
    && (v7 = &EventData[v6], v8 = *(unsigned __int16 *)&EventData[v6], (unsigned int)v8 >= 4)
    && (unsigned int)v8 <= (int)DataSize - (int)v6 )
  {
    DataDescriptor->Reserved = 0;
    DataDescriptor[1].Reserved = 0;
    DataDescriptor[2].Reserved = 0;
    DataDescriptor[2].Ptr = (unsigned __int64)&v7[v8];
    DataDescriptor[2].Size = DataSize - v6 - v8;
    DataDescriptor->Size = v6;
    DataDescriptor->Type = 2;
    DataDescriptor[1].Ptr = (unsigned __int64)v7;
    DataDescriptor[1].Size = v8;
    DataDescriptor[1].Type = 1;
  }
  else
  {
    DataDescriptor->Reserved = 0;
    v5 = 1;
    DataDescriptor->Size = DataSize;
  }
  DataDescriptor->Ptr = (unsigned __int64)EventData;
  *(_DWORD *)DataDesciptorCount = v5;
}

Referenced by:

BapdWriteEtwEvents