EtwpCreateKeyTreeForPath
NTSTATUS __fastcall EtwpCreateKeyTreeForPath(_WORD *a1){
int v2;
NTSTATUS v3;
__int64 v4;
__int64 v5;
NTSTATUS result;
__int16 v7;
__int16 SourceString[256];
v2 = 0;
v3 = 0;
memset((INT64)SourceString, 0i64);
LODWORD(v4) = 0;
if( *a1 )
{
while( (unsigned int)v4 < 0x100 )
{
v5 = (unsigned int)v4;
if( a1[(unsigned int)v4] == 92 && (unsigned int)++v2 > 3 )
{
result = EtwpCreateKey((PCWSTR)SourceString);
v3 = result;
if( result < 0 )
return result;
}
v7 = a1[(unsigned int)v4];
v4 = (unsigned int)(v4 + 1);
SourceString[v5] = v7;
if( !a1[v4] )
return v3;
}
}
return v3;
}Referenced by:
EtwStartAutoLogger