EtwpInitializeAutoLoggers

VOID __stdcall EtwpInitializeAutoLoggers(){
  __int128 v0; 
  __int128 v1; 
  __int128 v2; 
  __int128 v3; 
  __int128 v4; 
  __int128 v5; 
  int v6; 
  __int128 v7; 
  __int128 v8; 
  __int128 v9; 
  __int128 v10; 
  __int128 v11; 
  __int128 v12; 
  __int128 v13; 
  __int64 v14; 
  _RTL_AVL_TABLE *v15; 
  VOID **a5; 
  VOID **PoolWithTag; 
  INT64 a6; 
  INT64 a6a; 
  INT64 a7[2]; 
  _RTL_AVL_TABLE Table; 
  WCHAR LoggerName[16]; 
  __int128 Path[8]; 
  int v24; 
  __int128 LoggerKeyName[8]; 
  __int64 v26; 

  v0 = *(_OWORD *)L"y\\Machine\\System\\CurrentControlSet\\Control\\WMI\\AutoLogger";
  Path[0] = *(_OWORD *)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI\\AutoLogger";
  v1 = *(_OWORD *)L"e\\System\\CurrentControlSet\\Control\\WMI\\AutoLogger";
  Path[1] = v0;
  v2 = *(_OWORD *)L"\\CurrentControlSet\\Control\\WMI\\AutoLogger";
  Path[2] = v1;
  v3 = *(_OWORD *)L"ControlSet\\Control\\WMI\\AutoLogger";
  Path[3] = v2;
  v4 = *(_OWORD *)L"et\\Control\\WMI\\AutoLogger";
  Path[4] = v3;
  v5 = *(_OWORD *)L"ol\\WMI\\AutoLogger";
  Path[5] = v4;
  Path[6] = v5;
  v6 = *(_DWORD *)L"r";
  Path[7] = *(_OWORD *)L"utoLogger";
  v24 = v6;
  v7 = *(_OWORD *)L"y\\Machine\\System\\CurrentControlSet\\Control\\WMI\\GlobalLogger";
  LoggerKeyName[0] = *(_OWORD *)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI\\GlobalLogger";
  v8 = *(_OWORD *)L"e\\System\\CurrentControlSet\\Control\\WMI\\GlobalLogger";
  LoggerKeyName[1] = v7;
  v9 = *(_OWORD *)L"\\CurrentControlSet\\Control\\WMI\\GlobalLogger";
  LoggerKeyName[2] = v8;
  v10 = *(_OWORD *)L"ControlSet\\Control\\WMI\\GlobalLogger";
  LoggerKeyName[3] = v9;
  v11 = *(_OWORD *)L"et\\Control\\WMI\\GlobalLogger";
  LoggerKeyName[4] = v10;
  v12 = *(_OWORD *)L"ol\\WMI\\GlobalLogger";
  LoggerKeyName[5] = v11;
  v13 = *(_OWORD *)L"lobalLogger";
  v14 = *(_QWORD *)L"ger";
  LoggerKeyName[6] = v12;
  LoggerKeyName[7] = v13;
  v26 = v14;
  wcscpy(LoggerName, L"GlobalLogger");
  memset(&Table, 0i64, sizeof(Table));
  RtlInitializeGenericTableAvl(
    &Table,
    (PRTL_AVL_COMPARE_ROUTINE)EtwpAvlCompareKeyNames,
    (PRTL_AVL_ALLOCATE_ROUTINE)EtwpAllocateKeyNameEntry,
    (PRTL_AVL_FREE_ROUTINE)EtwpFreeKeyNameEntry,
    0i64);
  a5 = ExAllocatePoolWithTag(1ui64, 0x1FEui64, 1953985605i64);
  if( !a5 )
    goto LABEL_10;
  LODWORD(a6) = 510;
  if( RtlGetPersistedStateLocation((WCHAR *)L"ETWAutoLoggerPath", 0i64, 0i64, 0i64, a5, a6, (INT64)a7) )
  {
    ExFreePoolWithTag(a5, 0x74777445u);
    a5 = 0i64;
  }
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1FEui64, 1953985605i64);
  if( PoolWithTag )
  {
    LODWORD(a6a) = 510;
    if( RtlGetPersistedStateLocation((WCHAR *)L"ETWGlobalLoggerPath", 0i64, 0i64, 0i64, PoolWithTag, a6a, (INT64)a7) )
    {
      ExFreePoolWithTag(PoolWithTag, 0x74777445u);
      PoolWithTag = 0i64;
    }
    EtwStartAutoLogger(LoggerName, (WCHAR *)LoggerKeyName, (UINT64 *)PoolWithTag);
    EtwpEnumerateAutologgerPath((PCWSTR)Path);
    if( !a5 )
      goto LABEL_8;
    EtwpEnumerateAutologgerPath((PCWSTR)a5);
  }
  if( a5 )
    ExFreePoolWithTag(a5, 0x74777445u);
LABEL_8:
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x74777445u);
LABEL_10:
  EtwpFreeKeyNameList(&Table, v15);
}

Referenced by: