PerfDiagpStartPerfDiagLogger

NTSTATUS __stdcall PerfDiagpStartPerfDiagLogger(_NTSTRSAFE_PCWSTR pszSrc){
  __int64 v1; 
  WCHAR *v2; 
  UINT64 v3; 
  VOID **PoolWithTag; 
  WCHAR *v5; 
  unsigned __int64 v6; 
  unsigned __int64 v7; 
  _WORD *v8; 
  char *v9; 
  __int16 v10; 
  _WORD *v11; 
  NTSTATUS started; 

  v1 = -1i64;
  v2 = *(WCHAR **)&pszSrc;
  do
    ++v1;
  while( *(_WORD *)(*(_QWORD *)&pszSrc + 2 * v1) );
  v3 = (unsigned int)(2 * v1 + 104);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v3, 1682330192i64);
  v5 = (WCHAR *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  v6 = (unsigned __int64)(unsigned int)v3 >> 1;
  if( v6 )
  {
    v7 = 2147483646 - v6;
    v8 = PoolWithTag;
    v9 = (char *)((char *)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\" - (char *)PoolWithTag);
    do
    {
      if( !(v7 + v6) )
        break;
      v10 = *(_WORD *)((char *)v8 + (_QWORD)v9);
      if( !v10 )
        break;
      *v8++ = v10;
      --v6;
    }
    while( v6 );
    v11 = v8 - 1;
    if( v6 )
      v11 = v8;
    *v11 = 0;
  }
  RtlStringCbCatW(v5, v3, v2);
  if( (unsigned int)PerfDiagpIsTracingAllowed() )
  {
    *(_OWORD *)((char *)&ExBootDevicesRemovedEvent + 3660) = *(_OWORD *)L"PerfDiag Logger";
    *(_OWORD *)((char *)&ExBootDevicesRemovedEvent + 3676) = *(_OWORD *)L" Logger";
    started = EtwStartAutoLogger((WCHAR *)&ExBootDevicesRemovedEvent + 1830, v5, 0i64);
  }
  else
  {
    started = -1073741823;
  }
  ExFreePoolWithTag(v5, 0);
  return started;
}

Referenced by: