CmpAddRemoveContainerToCLFSLog

INT64 __stdcall CmpAddRemoveContainerToCLFSLog(
        PVOID LogFileObject,
        _UNICODE_STRING *Path,
        _UNICODE_STRING *Name,
        _UNICODE_STRING *Extension,
        _UNICODE_STRING *ContainerSuffix,
        UINT64 ContainerNum,
        UINT64 *ContainerSize,
        UINT8 Add){
  NTSTATUS v12; 
  INT8 v13; 
  int v14; 
  char v16; 
  _UNICODE_STRING Destination; 
  NTSTATUS v18; 
  _UNICODE_STRING DestinationString; 
  _STRING SourceString; 
  _SE_IMPERSONATION_STATE ImpersonationState; 
  _KAPC_STATE ApcState; 
  _EVENT_DATA_DESCRIPTOR v23; 
  char *v24; 
  int v25; 
  int v26; 
  int *v27; 
  int v28; 
  int v29; 
  int *v30; 
  int v31; 
  int v32; 
  wchar_t *Buffer; 
  int v34[2]; 
  INT8 Dst[16]; 

  SourceString = 0i64;
  Destination = 0i64;
  DestinationString = 0i64;
  ImpersonationState = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  RtlInitUnicodeString(&DestinationString, 0i64);
  Destination.MaximumLength = Path->Length + Name->Length + Extension->Length + ContainerSuffix->Length + 34;
  Destination.Buffer = (wchar_t *)ExAllocatePoolWithTag(1ui64, Destination.MaximumLength, 538987843i64);
  if( !Destination.Buffer )
    return 3221225626i64;
  RtlAppendUnicodeStringToString(&Destination, Path);
  RtlAppendUnicodeStringToString(&Destination, Name);
  RtlAppendUnicodeStringToString(&Destination, Extension);
  sprintf_s(Dst, 0x10ui64, (INT8 *)".%u", (unsigned int)ContainerNum);
  RtlInitAnsiString(&SourceString, Dst);
  v12 = RtlAnsiStringToUnicodeString(&DestinationString, &SourceString, 1u);
  if( v12 >= 0 && DestinationString.Length <= 0x20u )
  {
    RtlAppendUnicodeStringToString(&Destination, &DestinationString);
    RtlAppendUnicodeStringToString(&Destination, ContainerSuffix);
    v13 = PsDisableImpersonation((INT64)KeGetCurrentThread(), (INT64)&ImpersonationState);
    KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
    v12 = ClfsAddLogContainer((PLOG_FILE_OBJECT)LogFileObject, ContainerSize, &Destination);
    KiUnstackDetachProcess(&ApcState, 0i64);
    if( v13 )
      PsRestoreImpersonation((_ETHREAD *)KeGetCurrentThread(), &ImpersonationState);
  }
  if( *(&stru_140C00F40 + 1148) > 5u )
  {
    if( tlgKeywordOn((__int64)&stru_140C00F40 + 4592, 1i64) )
    {
      v26 = 0;
      v29 = 0;
      v32 = 0;
      v34[1] = 0;
      v24 = &v16;
      v27 = &v18;
      v30 = v34;
      Buffer = Destination.Buffer;
      v34[0] = Destination.Length;
      v16 = v14;
      v25 = v14;
      v18 = v12;
      v28 = 4;
      v31 = 2;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&stru_140C00F40 + 4592,
        (unsigned __int8 *)byte_1400230DB,
        0i64,
        0i64,
        6u,
        &v23);
    }
  }
  RtlFreeAnsiString(&DestinationString);
  ExFreePoolWithTag(Destination.Buffer, 0);
  return(unsigned int)v12;
}

Referenced by: