EtwpEnumerateAutologgerPath

NTSTATUS __stdcall EtwpEnumerateAutologgerPath(PCWSTR Path){
  const wchar_t *v1; 
  _RTL_AVL_TABLE *v2; 
  const wchar_t *v3; 
  UINT64 *v5; 
  __int64 v6; 
  unsigned int v7; 
  PCWSTR v8; 
  INT64 v9; 
  VOID **PoolWithTag; 
  UINT64 v11; 
  WCHAR *v12; 
  NTSTATUS v13; 
  UINT64 v14; 
  const WCHAR *v15; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  INT64 Length; 
  int *Lengtha; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  INT64 v23; 
  INT64 ValueData; 
  VOID *KeyHandle; 
  _RTL_AVL_TABLE *Table; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  int KeyInformation[72]; 

  Table = v2;
  v3 = v1;
  HIDWORD(v23) = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  LOBYTE(v23) = 0;
  v5 = 0i64;
  DestinationString = 0i64;
  memset(KeyInformation, 0i64, sizeof(KeyInformation));
  v6 = -1i64;
  v7 = 0;
  if( v3 )
  {
    v16 = -1i64;
    do
      ++v16;
    while( v3[v16] );
    v17 = -1i64;
    do
      ++v17;
    while( Path[v17] );
    v8 = Path;
    if( v17 <= v16 )
      v8 = v3;
  }
  else
  {
    v8 = Path;
  }
  do
    ++v6;
  while( v8[v6] );
  RtlInitUnicodeString(&DestinationString, Path);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(PoolWithTag) = ZwOpenKey(
                           &KeyHandle,
                           0x20019ui64,
                           &ObjectAttributes,
                           v9,
                           Length,
                           (INT64)ResultLength,
                           v23,
                           ValueData);
  if( (int)PoolWithTag >= 0 )
  {
    v11 = (unsigned int)(2 * v6 + 260);
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v11, 1953985605i64);
    v12 = (WCHAR *)PoolWithTag;
    if( PoolWithTag )
    {
      if( !v3 || (PoolWithTag = ExAllocatePoolWithTag(1ui64, v11, 1953985605i64), (v5 = (UINT64 *)PoolWithTag) != 0i64) )
      {
        do
        {
          LODWORD(Lengtha) = 286;
          v13 = ZwEnumerateKey(
                  KeyHandle,
                  v7,
                  KeyBasicInformation,
                  KeyInformation,
                  (UINT64)Lengtha,
                  (UINT64 *)((char *)&v23 + 4));
          LODWORD(PoolWithTag) = 0;
          if( v13 < 0 )
          {
            v14 = (unsigned int)v13;
            if( v13 == -2147483622 )
              v14 = 0i64;
            LODWORD(ValueData) = RtlNtStatusToDosError(v14);
            LODWORD(ResultLengtha) = 4;
            v15 = v3;
            if( !v3 )
              v15 = Path;
            LODWORD(PoolWithTag) = RtlWriteRegistryValue(0i64, v15, L"Status", 4ui64, &ValueData, (UINT64)ResultLengtha);
            if( v13 == -2147483643 || v13 == -1073741789 )
              v13 = 0;
          }
          else if( KeyInformation[3] < 0x102u )
          {
            *((_WORD *)&KeyInformation[4] + ((unsigned __int64)(unsigned int)KeyInformation[3] >> 1)) = 0;
            RtlInsertElementGenericTableAvl(
              Table,
              &KeyInformation[4],
              (unsigned int)(KeyInformation[3] + 2),
              (UINT8 *)&v23);
            LODWORD(PoolWithTag) = 0;
            if( (_BYTE)v23 )
            {
              Lengtha = &KeyInformation[4];
              LODWORD(PoolWithTag) = RtlStringCbPrintfW(v12, v11, (WCHAR *)L"%ws\\%ws");
              if( !(_DWORD)PoolWithTag )
              {
                if( !v3
                  || (Lengtha = &KeyInformation[4],
                      LODWORD(PoolWithTag) = RtlStringCbPrintfW((WCHAR *)v5, v11, (WCHAR *)L"%ws\\%ws"),
                      !(_DWORD)PoolWithTag) )
                {
                  LODWORD(PoolWithTag) = EtwStartAutoLogger((WCHAR *)&KeyInformation[4], v12, v5);
                }
              }
            }
          }
          ++v7;
        }
        while( v13 >= 0 );
      }
    }
    if( KeyHandle )
      LODWORD(PoolWithTag) = ZwClose((_HANDLE)KeyHandle);
    if( v12 )
      LODWORD(PoolWithTag) = (unsigned int)ExFreePoolWithTag(v12, 0);
    if( v5 )
      LODWORD(PoolWithTag) = (unsigned int)ExFreePoolWithTag(v5, 0);
  }
  return(int)PoolWithTag;
}

Referenced by: