EtwpCreateLogFile

NTSTATUS __stdcall EtwpCreateLogFile(_WMI_LOGGER_CONTEXT *LoggerContext, UINT8 Impersonate){
  char v4; 
  char v5; 
  _UNICODE_STRING NewLogFileName; 
  char v7; 
  bool CreateDirectoryTree; 
  int updated; 
  PVOID v10; 
  UINT8 v11; 
  void *LogFileHandle; 
  bool v13; 
  _UNICODE_STRING v14; 
  _UNICODE_STRING v16; 
  UINT64 RealTime; 
  __int64 Append; 
  PVOID FileHandle; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING FileName; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int128 FileInformation[2]; 
  __int64 v24; 

  LOBYTE(Append) = 0;
  FileHandle = 0i64;
  v24 = 0i64;
  memset(FileInformation, 0, sizeof(FileInformation));
  v4 = 0;
  v5 = 0;
  IoStatusBlock = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64);
  if( (LoggerContext->Flags & 4) != 0 )
  {
    _InterlockedAnd((volatile signed __int32 *)&LoggerContext->836, 0xFFFFFFFC);
    if( LoggerContext->LogFileName.Buffer || LoggerContext->NewLogFileName.Buffer )
    {
      if( LoggerContext->NewLogFileName.Buffer )
      {
        NewLogFileName = LoggerContext->NewLogFileName;
      }
      else
      {
        if( (LoggerContext->Flags & 2) != 0 )
        {
          ExAcquirePushLockExclusiveEx(&LoggerContext->LoggerLock, 0i64);
          EtwpExpandFileName(
            0,
            &LoggerContext->LogFileName,
            (unsigned int)LoggerContext->FileCounter,
            &LoggerContext->LoggerName);
          if( (_InterlockedExchangeAdd64(&LoggerContext->LoggerLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
            ExfTryToWakePushLock(&LoggerContext->LoggerLock);
          KeAbPostRelease(&LoggerContext->LoggerLock);
        }
        NewLogFileName = LoggerContext->LogFileName;
      }
      v7 = Append;
      if( (LoggerContext->LoggerMode & 4) != 0 )
        v7 = 1;
      CreateDirectoryTree = (LoggerContext->Flags & 2) != 0;
      LOBYTE(Append) = v7;
      FileName = NewLogFileName;
      if( Impersonate == 1 )
      {
        if( LoggerContext->ClientSecurityContext.ClientToken )
        {
          updated = SeImpersonateClientEx(&LoggerContext->ClientSecurityContext, 0i64);
          v5 = 1;
          if( updated < 0 )
            goto LABEL_25;
        }
      }
      updated = EtwpDelayCreate(
                  &FileHandle,
                  &FileName,
                  (UINT8 *)&Append,
                  ~(LoggerContext->LoggerMode >> 26) & 1,
                  0,
                  CreateDirectoryTree);
      if( v5 == 1 )
        PsRevertToSelf();
      v10 = FileHandle;
      if( updated >= 0 )
      {
        LODWORD(v24) = 0x2000;
        LODWORD(RealTime) = 4;
        ZwSetInformationFile((UINT64)FileHandle, (UINT64)&IoStatusBlock, (INT8 *)FileInformation, 0x28ui64, RealTime);
        if( LoggerContext->LogFileHandle )
        {
          EtwpFinalizeHeader(LoggerContext, 0i64, v11);
          LogFileHandle = LoggerContext->LogFileHandle;
        }
        else
        {
          v4 = 1;
          LogFileHandle = 0i64;
        }
        v13 = LoggerContext->NewLogFileName.Buffer == 0i64;
        LoggerContext->LogFileHandle = v10;
        if( !v13 )
        {
          ExAcquirePushLockExclusiveEx(&LoggerContext->LoggerLock, 0i64);
          v14 = LoggerContext->NewLogFileName;
          DestinationString = LoggerContext->LogFileName;
          LoggerContext->LogFileName = v14;
          if( (_InterlockedExchangeAdd64(&LoggerContext->LoggerLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
            ExfTryToWakePushLock(&LoggerContext->LoggerLock);
          KeAbPostRelease(&LoggerContext->LoggerLock);
          RtlInitUnicodeString(&LoggerContext->NewLogFileName, 0i64);
          v10 = FileHandle;
        }
        updated = EtwpUpdateFileHeader(LoggerContext, Append);
        if( updated < 0 )
        {
          LoggerContext->LogFileHandle = LogFileHandle;
        }
        else
        {
          if( !v4 )
            EtwpSendSessionNotification(LoggerContext, 1, 0i64);
          v10 = 0i64;
          FileHandle = 0i64;
          if( !LogFileHandle )
            goto LABEL_25;
          ZwClose((_HANDLE)LogFileHandle);
        }
      }
      if( v10 )
      {
        ZwClose((_HANDLE)v10);
        if( LoggerContext->LogFileHandle )
        {
          if( DestinationString.Buffer )
          {
            ExAcquirePushLockExclusiveEx(&LoggerContext->LoggerLock, 0i64);
            v16 = DestinationString;
            LoggerContext->NewLogFileName = LoggerContext->LogFileName;
            LoggerContext->LogFileName = v16;
            if( (_InterlockedExchangeAdd64(&LoggerContext->LoggerLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
              ExfTryToWakePushLock(&LoggerContext->LoggerLock);
            KeAbPostRelease(&LoggerContext->LoggerLock);
            RtlInitUnicodeString(&DestinationString, 0i64);
          }
        }
      }
LABEL_25:
      RtlFreeAnsiString(&LoggerContext->NewLogFileName);
      RtlFreeAnsiString(&DestinationString);
      return updated;
    }
  }
  return 0;
}

Referenced by: