EtwpInitLoggerContext

_WMI_LOGGER_CONTEXT *__fastcall EtwpInitLoggerContext(_UNICODE_STRING *LoggerName, UINT64 LoggerMode){
  int Length; 
  int v3; 
  unsigned int v5; 
  unsigned int v6; 
  VOID *PoolWithTag; 
  INT64 v8; 
  UINT8 *v9; 
  WCHAR v10; 
  __int64 v11; 
  int v12; 
  int v13; 
  unsigned int MaximumProcessorCount; 
  UINT8 *v16; 
  __int64 *v17; 
  Length = LoggerName->Length;
  v3 = LoggerMode;
  v5 = 0;
  v6 = 0;
  if( (LoggerMode & 0x10000000) == 0 )
  {
    MaximumProcessorCount = KeQueryMaximumProcessorCountEx(0xFFFFu);
    if( MaximumProcessorCount > 0x20 )
      v5 = 8 * MaximumProcessorCount;
    if( (v3 & 0x400) != 0 )
      v6 = 8 * MaximumProcessorCount;
  }
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNxCacheAligned, v5 + Length + 1330 + 2 * v6, 0x4C777445ui64);
  v8 = (INT64)PoolWithTag;
  if( !PoolWithTag )
    return 0i64;
  memset((INT64)PoolWithTag, 0i64);
  v9 = (UINT8 *)(v8 + 1328);
  if( v5 )
  {
    *(_QWORD *)(v8 + 1040) = v9;
    v9 += v5;
  }
  if( v6 )
  {
    *(_QWORD *)(v8 + 1280) = v9;
    v16 = &v9[v6];
    *(_QWORD *)(v8 + 1288) = v16;
    v9 = &v16[v6];
  }
  memmove(v9, (UINT8 *)LoggerName->Buffer, LoggerName->Length);
  RtlInitUnicodeString((PUNICODE_STRING)(v8 + 152), (PCWSTR)v9, v10);
  *(_DWORD *)(v8 + 12) = v3;
  *(_DWORD *)(v8 + 32) = 0xFFFF;
  *(_DWORD *)(v8 + 28) = -1072889856;
  *(_DWORD *)(v8 + 20) = -1072496640;
  *(_DWORD *)(v8 + 24) = -1072562176;
  *(_DWORD *)(v8 + 316) = (v3 & 0x1000000) != 0 ? 1 : 512;
  if( v3 < 0 && (v3 & 0x1000000) != 0 )
    *(_DWORD *)(v8 + 12) = v3 & 0x7FFFFFFF;
  if( EtwpFileSystemReady )
    _InterlockedOr((volatile signed __int32 *)(v8 + 832), 4u);
  if( (v3 & 0x8000) != 0 )
  {
    v17 = (__int64 *)(v8 + 288);
LABEL_29:
    *(_QWORD *)(v8 + 280) = v17;
    goto LABEL_12;
  }
  if( (v3 & 0x4000) != 0 )
  {
    v17 = EtwpGlobalSequence;
    goto LABEL_29;
  }
LABEL_12:
  *(_QWORD *)(v8 + 1296) = -1i64;
  *(_DWORD *)(v8 + 336) = 1;
  v11 = *(_QWORD *)(*(_QWORD *)qword_140C4E388 + 6928i64) << 12 >> 20;
  if( (unsigned int)v11 <= 0x200 )
  {
    *(_DWORD *)(v8 + 4) = 0x2000;
  }
  else
  {
    v12 = 0x10000;
    if( (unsigned int)v11 <= 0x400 )
      v12 = 0x4000;
    *(_DWORD *)(v8 + 4) = v12;
  }
  v13 = 2 * EtwpQueryUsedProcessorCount(v8);
  *(_DWORD *)(v8 + 240) = v13;
  if( (v3 & 0x4000000) == 0 )
    goto LABEL_17;
  if( EtwpInitializeCompression(v8) >= 0 )
  {
    *(_DWORD *)(v8 + 240) += 4;
    v13 = *(_DWORD *)(v8 + 240);
LABEL_17:
    *(_DWORD *)(v8 + 252) = v13 + 22;
    KeQuerySystemTimePrecise((_LARGE_INTEGER *)(v8 + 808));
    KeInitializeMutex((_KMUTANT *)(v8 + 648), 0i64);
    *(_QWORD *)(v8 + 704) = 0i64;
    *(_QWORD *)(v8 + 352) = v8 + 344;
    *(_QWORD *)(v8 + 344) = v8 + 344;
    *(_WORD *)(v8 + 1048) = 0;
    *(_QWORD *)(v8 + 64) = v8 + 72;
    *(_QWORD *)(v8 + 72) = 0i64;
    *(_QWORD *)(v8 + 80) = v8 + 88;
    *(_QWORD *)(v8 + 88) = 0i64;
    *(_QWORD *)(v8 + 104) = v8 + 96;
    *(_QWORD *)(v8 + 96) = v8 + 96;
    *(_QWORD *)(v8 + 120) = v8 + 112;
    *(_QWORD *)(v8 + 112) = v8 + 112;
    *(_QWORD *)(v8 + 1032) = v8 + 1024;
    *(_QWORD *)(v8 + 1024) = v8 + 1024;
    *(_QWORD *)(v8 + 1056) = 0i64;
    *(_QWORD *)(v8 + 712) = 0i64;
    KeInitializeEvent((_KEVENT *)(v8 + 472), NotificationEvent, 0);
    KeInitializeEvent((_KEVENT *)(v8 + 496), SynchronizationEvent, 0);
    KeInitializeTimerEx((PKTIMER)(v8 + 520), SynchronizationTimer);
    KeInitializeDpc((PRKDPC)(v8 + 584), EtwpLoggerDpc, (PVOID)v8);
    return(_WMI_LOGGER_CONTEXT *)v8;
  }
  ExFreePoolWithTag((PVOID)v8, 0);
  return 0i64;
}

Referenced by: