EtwpIsRegEntryAllowed

BOOL __fastcall EtwpIsRegEntryAllowed(INT64 a1, INT64 a2, INT64 a3, INT64 a4, INT64 a5, CHAR a6, CHAR a7){
  void **v7; 
  int v9; 
  void *retaddr; 
  v7 = &retaddr;
  v9 = *(_DWORD *)(a4 + 72);
  if( (*(_BYTE *)(a1 + 98) & 1) != 0 && (*(_BYTE *)(a3 + 17) || *(_BYTE *)(a3 + 18))
    || (v9 == 2 || *(_BYTE *)(a3 + 18)) && !EtwpApplyTransientFilters(a1, a4, *(_QWORD *)(a5 + 80), a5) )
  {
    goto LABEL_12;
  }
  if( (*(_BYTE *)(a1 + 98) & 8) != 0 )
  {
    if( a7 == 2 )
      goto LABEL_12;
    if( a6 )
      goto LABEL_12;
    if( !v9 )
    {
      v7 = *(void ***)(a1 + 32);
      if( *(_WORD *)(a4 + 104) != *((_WORD *)v7 + 44) )
        goto LABEL_12;
    }
  }
  if( *(_BYTE *)(a3 + 18) == 1 )
  {
    LODWORD(v7) = EtwpCheckCurrentUserProcessAccess(*(VOID **)(a1 + 80));
  }
  else
  {
    if( a7 == 2 && !EtwpIsGuidAllowed((_WMI_LOGGER_CONTEXT *)a2, (const _GUID *)(*(_QWORD *)(a1 + 32) + 40i64)) )
      goto LABEL_12;
    LODWORD(v7) = EtwpCheckProviderLoggingAccess(a1, (const GUID *)a3, *(_BYTE *)(a3 + 16));
  }
  if( (_DWORD)v7 )
  {
LABEL_12:
    LOBYTE(v7) = 0;
    return(int)v7;
  }
  LODWORD(v7) = 1;
  return(int)v7;
}

Referenced by: