PerfDiagpSaveActiveDCLLogFileName

VOID __stdcall PerfDiagpSaveActiveDCLLogFileName(){
  VOID **PoolWithTag; 
  unsigned __int16 v1; 
  UINT64 OutBufferLen; 
  UINT64 *ReturnLength; 
  UINT64 v4; 

  LODWORD(v4) = 0;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x20Aui64, 1682330192i64);
  if( PoolWithTag )
  {
    memset((char *)&ExBootDevicesRemovedEvent + 3696, 0i64, 0xB0u);
    wcscpy((wchar_t *)&ExBootDevicesRemovedEvent + 1830, L"WdiContextLog");
    *(&ExBootDevicesRemovedEvent + 935) = 0x20000;
    RtlInitUnicodeString((PUNICODE_STRING)&ExBootDevicesRemovedEvent + 240, (PCWSTR)&ExBootDevicesRemovedEvent + 1830);
    *(&ExBootDevicesRemovedEvent + 479) = PoolWithTag;
    *(&ExBootDevicesRemovedEvent + 1913) = 520;
    *(&ExBootDevicesRemovedEvent + 924) = 176;
    LODWORD(OutBufferLen) = 176;
    if( NtTraceControl(
           3ui64,
           (char *)&ExBootDevicesRemovedEvent + 3696,
           0xB0ui64,
           (char *)&ExBootDevicesRemovedEvent + 3696,
           OutBufferLen,
           &v4) < 0
      || *(&ExBootDevicesRemovedEvent + 1912) < 2u )
    {
      RtlDeleteRegistryValue(2ui64, L"Diagnostics\\Performance", L"ActiveShutdownDCL");
    }
    else
    {
      v1 = *(&ExBootDevicesRemovedEvent + 1912) >> 1;
      *((_WORD *)PoolWithTag + v1) = 0;
      LODWORD(ReturnLength) = 2 * (unsigned __int16)(v1 + 1);
      RtlWriteRegistryValue(
        2ui64,
        L"Diagnostics\\Performance",
        L"ActiveShutdownDCL",
        1ui64,
        PoolWithTag,
        (UINT64)ReturnLength);
    }
    ExFreePoolWithTag(PoolWithTag, 0);
  }
  else
  {
    RtlDeleteRegistryValue(2ui64, L"Diagnostics\\Performance", L"ActiveShutdownDCL");
  }
}

Referenced by: