EtwpGetAutoLoggerLevelKwFilter

VOID __fastcall EtwpGetAutoLoggerLevelKwFilter(INT64 a1, INT64 a2, VOID **a3){
  __int64 v4; 
  __int64 v5; 
  WCHAR *v7; 
  UINT64 v8; 
  WCHAR *PoolWithTag; 
  WCHAR *v10; 
  int v11; 
  WCHAR v12; 
  void *v13; 
  WCHAR *v14; 
  WCHAR v15; 
  HANDLE v16; 
  VOID *v17; 
  __int64 v18; 
  int v19; 
  void *KeyHandle; 
  HANDLE Handle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v24; 
  __int64 v25; 
  int v26; 
  __int64 v27; 
  int v28; 
  __int64 v29; 
  int v30; 
  __int64 v31; 
  INT64 result[4]; 
  int v33; 
  VOID *v34; 
  INT64(__stdcall *v35)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID); 
  const wchar_t *v36; 
  int *v37; 
  int v38; 
  __int64 v39; 
  INT64(__stdcall *v40)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID); 
  const WCHAR *v41; 
  int *v42; 
  int v43; 
  __int64 v44; 
  INT64(__stdcall *v45)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID); 
  const wchar_t *v46; 
  int *v47; 
  int v48; 
  __int64 v49; 
  v4 = -1i64;
  KeyHandle = 0i64;
  v5 = -1i64;
  Handle = 0i64;
  v7 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  do
    ++v5;
  while( *(_WORD *)(a1 + 2 * v5) );
  v8 = (unsigned int)(2 * v5 + 40);
  PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v8, 0x50777445ui64);
  v10 = PoolWithTag;
  if( !PoolWithTag )
    goto LABEL_11;
  v11 = RtlStringCbPrintfW(PoolWithTag, (unsigned int)v8, (WCHAR *)L"%ws\\StackLevelKwFilter");
  if( v11 )
    goto LABEL_10;
  RtlInitUnicodeString(&DestinationString, v10, v12);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v11 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  v13 = KeyHandle;
  if( v11 < 0 )
    v13 = 0i64;
  KeyHandle = v13;
  if( a2 )
  {
    do
      ++v4;
    while( *(_WORD *)(a2 + 2 * v4) );
    v14 = (WCHAR *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(2 * v4 + 40), 0x50777445ui64);
    v7 = v14;
    if( !v14 )
      goto LABEL_11;
    v11 = RtlStringCbPrintfW(v14, (unsigned int)(2 * v4 + 40), (WCHAR *)L"%ws\\StackLevelKwFilter");
    if( v11 )
      goto LABEL_10;
    RtlInitUnicodeString(&DestinationString, v7, v15);
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v11 = ZwOpenKey(&Handle, 0x20019u, &ObjectAttributes);
    v16 = Handle;
    if( v11 < 0 )
      v16 = 0i64;
    Handle = v16;
  }
  if( !KeyHandle && !Handle )
    goto LABEL_10;
  v17 = ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x50777445ui64);
  *a3 = v17;
  v18 = (__int64)v17;
  if( v17 )
  {
    memset((INT64)result, 0i64);
    v25 = v18;
    v33 = 11;
    v24 = 11;
    result[3] = (INT64)&v24;
    v38 = 11;
    result[2] = (INT64)L"MatchAnyKeyword";
    v26 = 11;
    v37 = &v26;
    result[0] = (INT64)EtwpQueryRegistryCallback;
    v36 = L"MatchAllKeyword";
    v35 = EtwpQueryRegistryCallback;
    v27 = v18 + 8;
    v42 = &v28;
    v41 = L"Level";
    v29 = v18 + 16;
    v47 = &v30;
    v46 = L"FilterIn";
    v40 = EtwpQueryRegistryCallback;
    v43 = 4;
    v28 = 4;
    v45 = EtwpQueryRegistryCallback;
    v48 = 4;
    v30 = 4;
    v31 = v18 + 17;
    LOBYTE(v19) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, (_KEXCEPTION_FRAME *)KeyHandle);
    v11 = v19;
    if( v19 >= 0 )
    {
      if( Handle )
      {
        v34 = *a3;
        v39 = (__int64)v34 + 8;
        v44 = (__int64)v34 + 16;
        v49 = (__int64)v34 + 17;
        RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, (_KEXCEPTION_FRAME *)Handle);
      }
LABEL_10:
      if( v11 >= 0 )
        goto LABEL_13;
    }
  }
LABEL_11:
  if( *a3 )
  {
    ExFreePoolWithTag(*a3, 0);
    *a3 = 0i64;
  }
LABEL_13:
  if( KeyHandle )
    ZwClose(KeyHandle);
  if( v10 )
    ExFreePoolWithTag(v10, 0);
  if( Handle )
    ZwClose(Handle);
  if( v7 )
    ExFreePoolWithTag(v7, 0);
}

Referenced by: