EtwStartAutoLogger

NTSTATUS __stdcall EtwStartAutoLogger(WCHAR *LoggerName, WCHAR *LoggerKeyName, UINT64 *LoggerId){
  UINT64 *v3; 
  void *v6; 
  VOID **v7; 
  INT64 v8; 
  NTSTATUS v9; 
  VOID **PoolWithTag; 
  _WORD *v11; 
  int v12; 
  _WORD *v13; 
  int v14; 
  int v15; 
  const WCHAR *v16; 
  unsigned int *v18; 
  int v19; 
  int v20; 
  unsigned int v21; 
  __int16 v22; 
  _DWORD *v23; 
  int v24; 
  _GUID v25; 
  __int64 v26; 
  _ETW_SILODRIVERSTATE *v27; 
  NTSTATUS started; 
  unsigned __int64 v29; 
  unsigned int v30; 
  _ESERVERSILO_GLOBALS *v31; 
  unsigned int v32; 
  const WCHAR *v33; 
  __int64 v34; 
  NTSTATUS KeyTreeForPath; 
  int v36; 
  _WORD *v37; 
  unsigned __int16 v38; 
  UINT16 v39; 
  __int64 v40; 
  VOID **v41; 
  unsigned int v42; 
  _GUID *v43; 
  int v44; 
  _ESERVERSILO_GLOBALS *CurrentServerSiloGlobals; 
  NTSTATUS v46; 
  VOID *ValueData; 
  VOID *ValueDataa; 
  INT64 ValueLength; 
  UINT64 ValueLengtha; 
  UINT64 *Disposition; 
  INT64 v52; 
  __int16 v53[2]; 
  _DWORD KeyLength[3]; 
  unsigned int v55; 
  int v56; 
  UINT64 v57; 
  _KEXCEPTION_FRAME *ExceptionFrame; 
  __int16 v59; 
  int v60; 
  int v61; 
  NTSTATUS v62; 
  VOID *KeyHandle; 
  _UNICODE_STRING SiloState; 
  int v65; 
  int v66; 
  int v67; 
  VOID *Src; 
  __int128 v69; 
  __int128 v70; 
  _UNICODE_STRING v71; 
  __int128 v72; 
  _UNICODE_STRING UnicodeString; 
  _UNICODE_STRING FilterString; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PWCHAR src; 
  _KEY_BASIC_INFORMATION *KeyInformation; 
  WCHAR *LoggerRegistryKeyName; 
  _GUID Guid; 
  int v81; 
  int *v82; 
  int v83; 
  _DWORD *v84; 
  int v85; 
  __int64 v86; 
  int v87; 
  __int64 v88; 
  int v89; 
  VOID **v90; 
  int v91; 
  VOID **v92; 
  int v93; 
  __int128 *v94; 
  int v95; 
  __int128 *v96; 
  int v97; 
  VOID **v98; 
  int v99; 
  __int64 v100; 
  int v101; 
  VOID **v102; 
  int v103; 
  int *v104; 
  int v105; 
  _UNICODE_STRING *p_UnicodeString; 
  int v107; 
  VOID **v108; 
  int v109; 
  unsigned int *v110; 
  int v111; 
  _UNICODE_STRING *p_FilterString; 
  int v113; 
  __int128 *v114; 
  int v115; 
  int *v116; 
  int v117; 
  _UNICODE_STRING *v118; 
  int v119; 
  VOID **v120; 
  __int64 v121[147]; 

  KeyInformation = (_KEY_BASIC_INFORMATION *)LoggerId;
  LoggerRegistryKeyName = LoggerKeyName;
  src = LoggerName;
  v3 = LoggerId;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v65 = 1;
  KeyHandle = 0i64;
  DestinationString = 0i64;
  ExceptionFrame = 0i64;
  v6 = 0i64;
  v62 = 0;
  v7 = 0i64;
  v60 = 0;
  UnicodeString = 0i64;
  v55 = 0;
  FilterString = 0i64;
  v61 = 0;
  v71 = 0i64;
  v56 = 0;
  v72 = 0i64;
  KeyLength[0] = 0;
  v70 = 0i64;
  v53[0] = 0;
  v69 = 0i64;
  v67 = 0;
  v66 = 100;
  v59 = 0;
  Guid = 0i64;
  *(_QWORD *)&SiloState.Length = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)LoggerName)->EtwSiloState;
  RtlInitUnicodeString(&DestinationString, LoggerKeyName);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v9 = ZwOpenKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, v8, (INT64)ValueData, ValueLength, (INT64)Disposition, v52);
  if( v9 >= 0 )
  {
    *(_QWORD *)&KeyLength[1] = ExAllocatePoolWithTag(1ui64, 0x2000ui64, 1350005829i64);
    v6 = *(void **)&KeyLength[1];
    if( *(_QWORD *)&KeyLength[1] )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x504ui64, 1350005829i64);
      v7 = PoolWithTag;
      if( PoolWithTag )
      {
        memset(PoolWithTag, 0i64, 0x504u);
        *((_DWORD *)v7 + 11) = 0x20000;
        *((_DWORD *)v7 + 12) = 4;
        RtlInitUnicodeString((PUNICODE_STRING)v7 + 9, LoggerName);
        *((_DWORD *)v7 + 18) = 0x80000000;
        *((_WORD *)v7 + 36) = 176;
        v11 = (_WORD *)v7 + 90;
        *((_BYTE *)v7 + 74) = -1;
        *((_DWORD *)v7 + 44) = 1;
        Src = v7 + 28;
        v12 = 180;
        v13 = (_WORD *)v7 + 626;
        memset(v121, 0i64, sizeof(v121));
        v121[0] = (__int64)EtwpQueryRegistryCallback;
        v121[3] = (__int64)&v81;
        v121[7] = (__int64)EtwpQueryRegistryCallback;
        v121[2] = (__int64)L"Start";
        LODWORD(v121[4]) = 4;
        v82 = &v60;
        v81 = 4;
        v121[10] = (__int64)&v83;
        v121[9] = (__int64)L"Immutable";
        v84 = KeyLength;
        LODWORD(v121[11]) = 4;
        v83 = 4;
        LOBYTE(v14) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, (_KEXCEPTION_FRAME *)KeyHandle);
        v9 = v14;
        if( v14 < 0 )
          goto LABEL_10;
        if( !v3 )
        {
          v15 = KeyLength[0];
          goto LABEL_7;
        }
        LODWORD(v57) = 0;
        RtlInitUnicodeString(&DestinationString, (PCWSTR)v3);
        ObjectAttributes.Length = 48;
        ObjectAttributes.ObjectName = &DestinationString;
        ObjectAttributes.RootDirectory = 0i64;
        LODWORD(ValueLengtha) = 0;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        v9 = ZwCreateKey((VOID **)&ExceptionFrame, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, ValueLengtha, &v57);
        if( v9 == -1073741772 )
        {
          KeyTreeForPath = EtwpCreateKeyTreeForPath(v3);
          LODWORD(v3) = 0;
          if( KeyTreeForPath )
            goto LABEL_78;
          LODWORD(ValueLengtha) = 0;
          v9 = ZwCreateKey((VOID **)&ExceptionFrame, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, ValueLengtha, &v57);
        }
        else
        {
          LODWORD(v3) = 0;
        }
        if( !v9 )
        {
LABEL_79:
          v15 = KeyLength[0];
          if( (_DWORD)v57 == 1 )
            v15 = 1;
          KeyLength[0] = v15;
LABEL_7:
          if( !v15 )
          {
            if( ExceptionFrame )
            {
              v121[5] = (__int64)&v60;
              memset(&v121[7], 0, 56);
              LOBYTE(v36) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, ExceptionFrame);
              v9 = v36;
              if( v36 < 0 )
                v9 = (int)v3;
            }
          }
          if( v60 != (_DWORD)v3 )
          {
            LODWORD(v72) = 40;
            LODWORD(v121[4]) = 4;
            v121[0] = (__int64)EtwpQueryRegistryCallback;
            v121[3] = (__int64)&v81;
            v81 = 4;
            v121[2] = (__int64)L"FlushThreshold";
            v121[7] = (__int64)EtwpQueryRegistryCallback;
            v82 = (int *)v7 + 19;
            LODWORD(v121[11]) = 4;
            v121[10] = (__int64)&v83;
            v121[9] = (__int64)L"BufferSize";
            v121[17] = (__int64)&v85;
            v121[16] = (__int64)L"MinimumBuffers";
            v86 = (__int64)v7 + 52;
            v121[24] = (__int64)&v87;
            v121[23] = (__int64)L"FlushTimer";
            v88 = (__int64)v7 + 68;
            v121[31] = (__int64)&v89;
            v121[30] = (__int64)L"MaximumBuffers";
            v90 = v7 + 7;
            v121[38] = (__int64)&v91;
            v121[37] = (__int64)L"FileName";
            v121[40] = (__int64)v53;
            v92 = v7 + 16;
            *((_QWORD *)&v72 + 1) = v7 + 23;
            v121[45] = (__int64)&v93;
            v121[44] = (__int64)L"EnableKernelFlags";
            v94 = &v72;
            *((_QWORD *)&v69 + 1) = (char *)v7 + 228;
            v121[52] = (__int64)&v95;
            v121[51] = (__int64)L"StackWalkingFilter";
            v83 = 4;
            v84 = v7 + 6;
            v121[14] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[18]) = 4;
            v85 = 4;
            v121[21] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[25]) = 4;
            v87 = 4;
            v121[28] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[32]) = 4;
            v89 = 4;
            v121[35] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[39]) = 1;
            v91 = 1;
            v121[42] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[46]) = 3;
            v93 = 3;
            LODWORD(v69) = 1024;
            v121[49] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[53]) = 3;
            v95 = 3;
            v96 = &v69;
            v18 = (unsigned int *)(v7 + 12);
            v121[56] = (__int64)EtwpQueryRegistryCallback;
            v121[59] = (__int64)&v97;
            v121[58] = (__int64)L"ClockType";
            v121[61] = (__int64)&v65;
            v98 = v7 + 5;
            v121[66] = (__int64)&v99;
            v121[65] = (__int64)L"MaxFileSize";
            v121[68] = (__int64)&v66;
            v100 = (__int64)v7 + 60;
            v121[73] = (__int64)&v101;
            v121[72] = (__int64)L"LogFileMode";
            v121[75] = (__int64)&v67;
            v102 = v7 + 8;
            v121[80] = (__int64)&v103;
            v121[79] = (__int64)L"DisableRealtimePersistence";
            v104 = &v61;
            v121[87] = (__int64)&v105;
            v121[86] = (__int64)L"Guid";
            v121[89] = (__int64)v53;
            p_UnicodeString = &UnicodeString;
            v121[94] = (__int64)&v107;
            v121[93] = (__int64)L"FileCounter";
            v121[101] = (__int64)&v109;
            v121[100] = (__int64)L"FileMax";
            v110 = &v55;
            v121[108] = (__int64)&v111;
            LODWORD(v121[60]) = 4;
            LODWORD(v121[62]) = 4;
            v97 = 4;
            v121[63] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[67]) = 4;
            LODWORD(v121[69]) = 4;
            v99 = 4;
            v121[70] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[74]) = 4;
            LODWORD(v121[76]) = 4;
            v101 = 4;
            v121[77] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[81]) = 4;
            v103 = 4;
            v121[84] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[88]) = 1;
            v105 = 1;
            v121[91] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[95]) = 4;
            v107 = 4;
            v108 = v7 + 12;
            v121[98] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[102]) = 4;
            v109 = 4;
            v121[105] = (__int64)EtwpQueryRegistryCallback;
            v121[107] = (__int64)L"PoolTagFilter";
            LODWORD(v121[109]) = 1;
            v121[110] = (__int64)v53;
            p_FilterString = &FilterString;
            *((_QWORD *)&v70 + 1) = (char *)v7 + 1276;
            v121[115] = (__int64)&v113;
            v121[114] = (__int64)L"StackCaching";
            v114 = &v70;
            v121[122] = (__int64)&v115;
            v121[121] = (__int64)L"EnableSecurityProvider";
            v116 = &v56;
            v121[129] = (__int64)&v117;
            v121[128] = (__int64)L"DisallowList";
            v121[131] = (__int64)v53;
            v118 = &v71;
            v121[136] = (__int64)&v119;
            v121[135] = (__int64)L"V2Options";
            LODWORD(v121[137]) = 11;
            v119 = 11;
            v111 = 1;
            v121[112] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[116]) = 3;
            v113 = 3;
            v121[119] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[123]) = 4;
            v115 = 4;
            v121[126] = (__int64)EtwpQueryRegistryCallback;
            LODWORD(v121[130]) = 1;
            v117 = 1;
            v121[133] = (__int64)EtwpQueryRegistryCallback;
            v120 = v7 + 10;
            LODWORD(v70) = 8;
            LODWORD(v121[139]) = 8;
            LOBYTE(v19) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, (_KEXCEPTION_FRAME *)KeyHandle);
            v9 = v19;
            if( v19 >= 0 )
            {
              if( ExceptionFrame )
              {
                if( KeyLength[0] )
                {
                  v121[5] = (__int64)(v7 + 12);
                  v121[3] = (__int64)&v107;
                  v121[0] = (__int64)EtwpQueryRegistryCallback;
                  v121[2] = (__int64)L"FileCounter";
                  LODWORD(v121[4]) = 4;
                  v81 = 4;
                  v82 = (int *)(v7 + 12);
                  v121[7] = 0i64;
                }
                else
                {
                  v121[12] = (__int64)(v7 + 6);
                  v121[5] = (__int64)v7 + 76;
                  v121[19] = (__int64)v7 + 52;
                  v121[26] = (__int64)v7 + 68;
                  v121[33] = (__int64)(v7 + 7);
                  v121[40] = (__int64)v7[17];
                  LODWORD(v121[41]) = *((unsigned __int16 *)v7 + 64);
                  v121[47] = *((_QWORD *)&v72 + 1);
                  LODWORD(v121[48]) = v72;
                  v121[54] = *((_QWORD *)&v69 + 1);
                  LODWORD(v121[55]) = v69;
                  v121[61] = (__int64)(v7 + 5);
                  v121[68] = (__int64)v7 + 60;
                  v121[75] = (__int64)(v7 + 8);
                  v121[82] = (__int64)&v61;
                  v121[89] = (__int64)UnicodeString.Buffer;
                  LODWORD(v121[90]) = UnicodeString.Length;
                  v121[103] = (__int64)&v55;
                  v121[110] = (__int64)FilterString.Buffer;
                  LODWORD(v121[111]) = FilterString.Length;
                  v121[117] = *((_QWORD *)&v70 + 1);
                  LODWORD(v121[118]) = v70;
                  v121[124] = (__int64)&v56;
                  v121[131] = (__int64)v71.Buffer;
                  LODWORD(v121[132]) = v71.Length;
                  v121[96] = (__int64)(v7 + 12);
                }
                RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, ExceptionFrame);
                v9 = 0;
              }
              v20 = *((_DWORD *)v7 + 28) | 2;
              *((_DWORD *)v7 + 28) = v20;
              if( !v61 )
                *((_DWORD *)v7 + 28) = v20 | 1;
              v21 = (unsigned int)v72 >> 2;
              if( (unsigned __int16)((unsigned int)v72 >> 2) )
              {
                *((_WORD *)v7 + 91) = 1;
                *v11 = v21 + 1;
                ++*((_WORD *)v7 + 89);
                *((_WORD *)v7 + 88) += *v11;
                v12 = 4 * (unsigned __int16)*v11 + 180;
              }
              if( (_DWORD)v69 )
              {
                v37 = Src;
                v38 = ((unsigned int)v69 >> 2) + 1;
                if( (v69 & 3) == 0 )
                  v38 = (unsigned int)v69 >> 2;
                *((_WORD *)Src + 1) = 3;
                *v37 = v38 + 1;
                ++*((_WORD *)v7 + 89);
                *((_WORD *)v7 + 88) += *v37;
                v12 += 4 * (unsigned __int16)*v37;
                if( (_WORD)v21 )
                  v11 += 2 * (unsigned __int16)*v11;
                if( v11 != v37 )
                  memmove(v11, v37, 4 * v38 + 4);
              }
              if( FilterString.Buffer )
              {
                Src = (char *)v7 + 4 * *((unsigned __int16 *)v7 + 88) + 176;
                v39 = EtwpParsePoolTagFilter(&FilterString, (UINT64 *)v7 + 157);
                v22 = v39;
                if( v39 )
                {
                  *v13 = v39 + 1;
                  *((_WORD *)v7 + 627) = 4;
                  ++*((_WORD *)v7 + 89);
                  *((_WORD *)v7 + 88) += *v13;
                  v12 += 4 * (unsigned __int16)*v13;
                  if( Src != v13 )
                    memmove(Src, (char *)v7 + 1252, 4 * v39 + 4);
                }
              }
              else
              {
                v22 = v59;
              }
              if( (_DWORD)v70 == 8 )
              {
                v40 = *((unsigned __int16 *)v7 + 88);
                *((_DWORD *)v7 + 318) = 327683;
                ++*((_WORD *)v7 + 89);
                *((_WORD *)v7 + 88) += *((_WORD *)v7 + 636);
                v41 = (VOID **)((char *)v7 + 4 * v40 + 176);
                v12 += 4 * *((unsigned __int16 *)v7 + 636);
                if( v41 != v7 + 159 )
                  memmove(v41, v7 + 159, 0xCu);
              }
              if( !(_WORD)v21 && !(_DWORD)v69 && !(_DWORD)v70 && !v22 )
                *((_DWORD *)v7 + 18) = 0;
              v23 = v7 + 8;
              v24 = *((_DWORD *)v7 + 16);
              if( (v24 & 0x500) != 0 && (v24 & 0x200) == 0 || v7[17] )
              {
LABEL_41:
                if( v9 >= 0 )
                {
                  if( v56 )
                  {
                    if( (*v23 & 0x80u) == 0 || (*v23 & 0x100) == 0 || v7[17] )
                      v9 = -1073741790;
                    else
                      *((_DWORD *)v7 + 28) |= 0x8004000u;
                  }
                  if( v9 >= 0 )
                  {
                    if( v55 )
                    {
                      v32 = *v18 + 1;
                      *v18 = v32;
                      if( v32 > v55 || v32 > 0x10 )
                        *v18 = 1;
                      v33 = (const WCHAR *)ExceptionFrame;
                      if( !ExceptionFrame )
                        v33 = (const WCHAR *)KeyHandle;
                      LODWORD(ValueLengtha) = 4;
                      RtlWriteRegistryValue(0x40000000ui64, v33, L"FileCounter", 4ui64, v7 + 12, ValueLengtha);
                    }
                    if( !wcscmp(src, (PWCHAR)L"GlobalLogger") )
                      Guid = GlobalLoggerGuid;
                    else
                      v9 = UnicodeString.Buffer ? RtlGUIDFromString(&UnicodeString, &Guid) : -1073741811;
                    if( v9 >= 0 )
                    {
                      v25 = Guid;
                      v26 = *(_QWORD *)&SiloState.Length;
                      v27 = *(_ETW_SILODRIVERSTATE **)&SiloState.Length;
                      *(_DWORD *)v7 = v12;
                      *(_GUID *)(v7 + 3) = v25;
                      started = EtwpStartLogger(v27, (_WMI_LOGGER_INFORMATION *)v7);
                      v30 = *((unsigned __int16 *)v7 + 4);
                      v9 = started;
                      if( started >= 0 )
                      {
                        if( *((_WORD *)v7 + 4) && v56 )
                        {
                          v34 = 0i64;
                          v29 = v26 + 4048;
                          while( *(_WORD *)v29 )
                          {
                            v34 = (unsigned int)(v34 + 1);
                            v29 += 2i64;
                            if( (unsigned int)v34 >= 8 )
                              goto LABEL_52;
                          }
                          *(_WORD *)(v26 + 2 * v34 + 4048) = v30;
                        }
LABEL_52:
                        if( v71.Length )
                        {
                          v42 = v71.Length / 0x4Cu;
                          v29 = v71.Length % 0x4Cu;
                          if( v71.Length == 76 * v42 )
                          {
                            v29 = 76i64;
                            SiloState.Buffer = v71.Buffer;
                            *(&SiloState.MaximumLength + 2) = 0;
                            SiloState.Length = 76;
                            *(_DWORD *)&SiloState.MaximumLength = (unsigned __int16)(v71.MaximumLength - v71.Length + 76);
                            if( v42 <= 0x200 )
                            {
                              v43 = *(_GUID **)&KeyLength[1];
                              v44 = 0;
                              if( v42 )
                              {
                                while( 1 )
                                {
                                  v9 = RtlGUIDFromString(&SiloState, &v43[v44]);
                                  if( v9 )
                                    break;
                                  SiloState.Buffer += 38;
                                  if( ++v44 >= v42 )
                                    goto LABEL_110;
                                }
                              }
                              else
                              {
LABEL_110:
                                if( !v9 )
                                {
                                  CurrentServerSiloGlobals = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)v29);
                                  EtwpUpdateDisallowList(CurrentServerSiloGlobals->EtwSiloState, v30, v42, v43);
                                }
                              }
                            }
                          }
                        }
                        v31 = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)v29);
                        LODWORD(ValueDataa) = KeyLength[0];
                        EtwpEnableKeyProviders(
                          v31->EtwSiloState,
                          v30,
                          LoggerRegistryKeyName,
                          KeyInformation,
                          (UINT64)ValueDataa);
                      }
                    }
                  }
                }
                goto LABEL_10;
              }
              if( RtlCreateUnicodeString((INT64)(v7 + 16), (INT8 *)L"%SystemRoot%") )
              {
                v9 = 0;
                v23 = v7 + 8;
                goto LABEL_41;
              }
              v9 = -1073741801;
            }
          }
LABEL_10:
          v6 = *(void **)&KeyLength[1];
          goto LABEL_11;
        }
LABEL_78:
        v9 = 0;
        ExceptionFrame = 0i64;
        goto LABEL_79;
      }
    }
    v9 = -1073741801;
  }
LABEL_11:
  v16 = (const WCHAR *)KeyHandle;
  if( KeyHandle )
  {
    if( v9 < 0 )
    {
      v46 = RtlNtStatusToDosError((unsigned int)v9);
      v16 = (const WCHAR *)KeyHandle;
      v62 = v46;
    }
    LODWORD(ValueLengtha) = 4;
    if( ExceptionFrame )
      v16 = (const WCHAR *)ExceptionFrame;
    RtlWriteRegistryValue(0x40000000ui64, v16, L"Status", 4ui64, &v62, ValueLengtha);
    ZwClose((_HANDLE)KeyHandle);
  }
  if( ExceptionFrame )
    ZwClose((_HANDLE)ExceptionFrame);
  if( v7 )
  {
    RtlFreeAnsiString((_UNICODE_STRING *)v7 + 8);
    ExFreePoolWithTag(v7, 0);
  }
  if( v6 )
    ExFreePoolWithTag(v6, 0);
  RtlFreeAnsiString(&UnicodeString);
  RtlFreeAnsiString(&FilterString);
  RtlFreeAnsiString(&v71);
  return v9;
}

Referenced by: