EtwpValidateFlagExtension

__int64 __fastcall EtwpValidateFlagExtension(unsigned int *a1){
  int v1; 
  unsigned __int64 v3; 
  unsigned __int16 *v4; 
  unsigned __int16 v5; 
  unsigned __int16 *v6; 
  unsigned __int16 v7; 
  __int16 v8; 
  __int64 v9; 
  v1 = a1[18];
  if( v1 >= 0 )
    return 0i64;
  if( BYTE2(v1) != 0xFF )
    return 3221225485i64;
  if( !(_WORD)v1 )
    return 3221225485i64;
  v3 = *a1;
  if( v3 < (unsigned __int64)(unsigned __int16)v1 + 4 )
    return 3221225485i64;
  v4 = (unsigned __int16 *)((char *)a1 + (unsigned __int16)v1);
  if( (((_BYTE)v1 + (_BYTE)a1) & 1) == 0 )
  {
    if( *v4 && 4 * (unsigned __int64)*v4 <= (unsigned int)v3 - (unsigned __int16)v1 )
    {
      v5 = v4[1];
      v6 = v4 + 2;
      v7 = *v4 - 1;
      v8 = 0;
      if( v5 )
      {
        while( ((unsigned __int8)v6 & 1) == 0 )
        {
          if( !v7 )
            return 3221225485i64;
          v9 = *v6;
          if( v7 < (unsigned __int16)v9 )
            return 3221225485i64;
          v7 -= v9;
          v6 += 2 * v9;
          if( (unsigned __int16)++v8 >= v5 )
            goto LABEL_14;
        }
        return 3221226181i64;
      }
LABEL_14:
      if( !v7 )
        return 0i64;
    }
    return 3221225485i64;
  }
  return 3221226181i64;
}

Referenced by: