EtwpCalculateUpdateNotification

CHAR __fastcall EtwpCalculateUpdateNotification(
        INT64 a1,
        UINT8 a2,
        UINT8 a3,
        CHAR a4,
        CHAR a5,
        CHAR a6,
        INT64 a7,
        CHAR **a8){
  unsigned __int8 v9; 
  char v10; 
  __int16 v11; 
  CHAR *v13; 
  __int64 v14; 
  UINT8 v15; 
  __int128 v16; 
  int SchematizedFilterSize; 
  CHAR *v18; 
  __int128 Source2[2]; 
  __m256i v20; 
  __int64 v21; 
  _TRACE_ENABLE_INFO EnableInfo; 
  __int64 v23; 
  int v24; 
  if( a5 )
  {
    if( a6 )
      v9 = *(_BYTE *)(a1 + 103);
    else
      v9 = *(_BYTE *)(a1 + 101);
    v10 = 0;
  }
  else if( a6 )
  {
    v9 = *(_BYTE *)(a1 + 102);
    v10 = *(_BYTE *)(a1 + 100);
  }
  else
  {
    v9 = *(_BYTE *)(a1 + 100);
    v10 = *(_BYTE *)(a1 + 102);
  }
  v11 = *(_WORD *)(a1 + 98) & 8;
  if( !v11 )
  {
    if( (a2 & a3) == 0 && (v9 & a2) == 0 )
      return 0;
    if( a4 == v9 && a5 != 2 && !v10 && !*(_BYTE *)(a1 + 101) && !*(_BYTE *)(a1 + 103) )
      goto LABEL_11;
    goto LABEL_17;
  }
  if( v9 || (_DWORD)a7 != 1 )
  {
LABEL_11:
    *a8 = 0i64;
    return 1;
  }
  if( a3 )
  {
LABEL_17:
    memset((INT64)Source2, 0i64);
    v13 = *a8;
    v14 = *(_QWORD *)(a1 + 32);
    v15 = *(_BYTE *)(a1 + 100);
    Source2[0] = *(_OWORD *)*a8;
    Source2[1] = *((_OWORD *)v13 + 1);
    v20 = *(__m256i *)(v13 + 1);
    v21 = *((_QWORD *)v13 + 8);
    v16 = *(_OWORD *)(v14 + 40);
    *(_QWORD *)((char *)Source2 + 4) = 0x100000078i64;
    *(_OWORD *)&v20.m256i_u64[1] = v16;
    SchematizedFilterSize = EtwpGetSchematizedFilterSize((_ETW_GUID_ENTRY *)v14, v15);
    if( SchematizedFilterSize )
      DWORD1(Source2[0]) = SchematizedFilterSize + 136;
    EtwpComputeRegEntryEnableInfo((_ETW_REG_ENTRY *)a1, &EnableInfo);
    if( v11 )
    {
      v23 = 0i64;
      v24 = 0;
    }
    if( !v13
      || (*((_DWORD *)v13 + 1) == DWORD1(Source2[0]) && RtlCompareMemory(v13, Source2, 0x78ui64) == 120 ? (v18 = *a8) : (*a8 = 0i64, v18 = 0i64),
          !v18) )
    {
      if( (int)EtwpBuildNotificationPacket(*(_QWORD *)(a1 + 32), Source2, *(_BYTE *)(a1 + 100), (__int64 *)a8) < 0 )
        return 0;
    }
    return 1;
  }
  return 0;
}

Referenced by: