EtwpApplyContainerFilter

CHAR __fastcall EtwpApplyContainerFilter(INT64 a1, _WORD *a2, WCHAR a3){
  __int64 v3; 
  CHAR v5; 
  __int64 v6; 
  unsigned __int16 Length; 
  wchar_t *Buffer; 
  __int64 v9; 
  const CHAR *v11; 
  unsigned __int16 v12; 
  unsigned int v13; 
  UINT64 UTF8StringByteCount; 
  struct _UNICODE_STRING DestinationString; 
  UINT64 UnicodeStringActualByteCount; 
  v3 = *(_QWORD *)(a1 + 32);
  DestinationString = 0i64;
  v5 = 1;
  v6 = *(_QWORD *)(v3 + 392);
  if( v6 == EtwpHostSiloState )
  {
    RtlInitUnicodeString(&DestinationString, L"Host", a3);
    Length = DestinationString.Length;
    Buffer = DestinationString.Buffer;
  }
  else
  {
    v9 = *(unsigned __int16 *)(v6 + 4200);
    LODWORD(UnicodeStringActualByteCount) = 0;
    DestinationString.Buffer = (wchar_t *)ExAllocatePoolWithTag(NonPagedPoolNx, 2 * v9 + 2, 0x46777445ui64);
    Buffer = DestinationString.Buffer;
    if( !DestinationString.Buffer )
      return 1;
    v11 = *(const CHAR **)(v6 + 4192);
    LODWORD(UTF8StringByteCount) = *(unsigned __int16 *)(v6 + 4200);
    DestinationString.MaximumLength = 2 * (UTF8StringByteCount + 1);
    RtlUTF8ToUnicodeN(
      DestinationString.Buffer,
      DestinationString.MaximumLength,
      &UnicodeStringActualByteCount,
      v11,
      UTF8StringByteCount);
    Length = UnicodeStringActualByteCount;
    DestinationString.Length = UnicodeStringActualByteCount;
  }
  v12 = 0;
  v13 = Length >> 1;
  if( *a2 )
  {
    while( (unsigned __int16)a2[8 * v12 + 4] != v13 || wcsnicmp(*(const wchar_t **)&a2[8 * v12 + 8], Buffer, v13) )
    {
      if( ++v12 >= *a2 )
        goto LABEL_10;
    }
  }
  else
  {
LABEL_10:
    v5 = 0;
  }
  if( v6 != EtwpHostSiloState )
    RtlFreeAnsiString(&DestinationString);
  return v5;
}

Referenced by: