CmpStartCLFSLog

__int64 __fastcall CmpStartCLFSLog(
        _UNICODE_STRING *Source,
        _UNICODE_STRING *a2,
        __int64 a3,
        void *a4,
        int a5,
        __int64 a6,
        __int64 a7,
        __int64 a8,
        __int64 a9){
  unsigned __int16 v12; 
  INT8 v13; 
  int LogFileInformation; 
  VOID **PoolWithTag; 
  VOID **v16; 
  int v17; 
  UINT64 fCreateDisposition; 
  UINT8 fFlagsAndAttributes; 
  _FILE_OBJECT *pplfoLog; 
  unsigned int pcbInfoBuffer; 
  _UNICODE_STRING Destination; 
  PVOID ppvMarshalContext; 
  PULONGLONG pcbContainer; 
  _DWORD *v26; 
  _SE_IMPERSONATION_STATE ImpersonationState; 
  _KAPC_STATE ApcState; 

  pcbContainer = (PULONGLONG)a6;
  *(_QWORD *)a8 = 0i64;
  *(_QWORD *)a9 = 0i64;
  v26 = (_DWORD *)a7;
  v12 = Source->Length + 26 + a2->Length;
  pcbInfoBuffer = 0;
  *(_QWORD *)&Destination.Length = 0i64;
  Destination.MaximumLength = v12;
  ImpersonationState = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  Destination.Buffer = (wchar_t *)ExAllocatePoolWithTag(1ui64, v12, 538987843i64);
  if( !Destination.Buffer )
    return 3221225626i64;
  *(_QWORD *)a8 = 0i64;
  *(_QWORD *)a9 = 0i64;
  RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)&CmpLogPrefix);
  RtlAppendUnicodeStringToString(&Destination, Source);
  RtlAppendUnicodeStringToString(&Destination, a2);
  RtlAppendUnicodeStringToString(&Destination, (_UNICODE_STRING *)&CmpLogExt);
  pplfoLog = 0i64;
  ppvMarshalContext = 0i64;
  v13 = PsDisableImpersonation((INT64)KeGetCurrentThread(), (INT64)&ImpersonationState);
  KeStackAttachProcess(&PsInitialSystemProcess->Pcb, &ApcState);
  LogFileInformation = ClfsCreateLogFile(&pplfoLog, &Destination, 0xC0010000, 0, a4, 1u, 8u, 0, 0x200u, 0i64, 0);
  if( LogFileInformation < 0 )
  {
    if( LogFileInformation == -1073741772 )
    {
      LogFileInformation = ClfsCreateLogFile(&pplfoLog, &Destination, 0xC0010000, 0, a4, 2u, 8u, 0, 0x200u, 0i64, 0);
      if( LogFileInformation >= 0 )
      {
        v17 = 0;
        while( 1 )
        {
          LODWORD(fCreateDisposition) = v17;
          LogFileInformation = CmpAddRemoveContainerToCLFSLog(
                                 pplfoLog,
                                 Source,
                                 a2,
                                 (_UNICODE_STRING *)&CmpLogExt,
                                 (_UNICODE_STRING *)&CmpContainerSuffix,
                                 fCreateDisposition,
                                 pcbContainer,
                                 fFlagsAndAttributes);
          if( LogFileInformation < 0 )
            break;
          if( (unsigned int)++v17 >= 3 )
            goto LABEL_6;
        }
      }
    }
  }
  else
  {
    pcbInfoBuffer = 120;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x78ui64, 538987843i64);
    v16 = PoolWithTag;
    if( PoolWithTag )
    {
      LogFileInformation = ClfsGetLogFileInformation(pplfoLog, (PCLFS_INFORMATION)PoolWithTag, &pcbInfoBuffer);
      if( LogFileInformation < 0 )
      {
        ExFreePoolWithTag(v16, 0);
      }
      else
      {
        v17 = *((_DWORD *)v16 + 10);
        ExFreePoolWithTag(v16, 0);
LABEL_6:
        LogFileInformation = ClfsCreateMarshallingArea(
                               pplfoLog,
                               PagedPool,
                               0i64,
                               0i64,
                               0x1000u,
                               2u,
                               0x14u,
                               &ppvMarshalContext);
        if( LogFileInformation >= 0 )
        {
          *v26 = v17;
          *(_QWORD *)a8 = pplfoLog;
          *(_QWORD *)a9 = ppvMarshalContext;
        }
      }
    }
    else
    {
      LogFileInformation = -1073741670;
    }
  }
  KeUnstackDetachProcess(&ApcState);
  if( v13 )
    PsRestoreImpersonation((_ETHREAD *)KeGetCurrentThread(), &ImpersonationState);
  ExFreePoolWithTag(Destination.Buffer, 0);
  if( LogFileInformation < 0 )
  {
    if( pplfoLog )
      ClfsCloseLogFileObject(pplfoLog);
  }
  return(unsigned int)LogFileInformation;
}

Referenced by: