CmpStartCLFSLog

INT64 __stdcall CmpStartCLFSLog(
        UNICODE_STRING *Path,
        UNICODE_STRING *Name,
        PVOID SecurityDescriptor,
        UINT64 *ContainerSize,
        UINT64 *ContainerNum,
        PVOID *LogFileObject,
        PVOID *MarshallingContext){
  unsigned __int16 v10; 
  BOOLEAN v11; 
  NTSTATUS LogFileInformation; 
  CLFS_INFORMATION *PoolWithTag; 
  CLFS_INFORMATION *v14; 
  int v15; 
  UINT64 fCreateDisposition; 
  UINT8 fFlagsAndAttributes; 
  FILE_OBJECT *pplfoLog; 
  ULONG pcbInfoBuffer; 
  struct _UNICODE_STRING Destination; 
  PVOID ppvMarshalContext; 
  PULONGLONG pcbContainer; 
  PVOID *v24; 
  struct _SE_IMPERSONATION_STATE ImpersonationState; 
  struct _KAPC_STATE ApcState; 
  FILE_OBJECT **v27; 
  PVOID *v28; 
  pcbContainer = (PULONGLONG)LogFileObject;
  *v27 = 0i64;
  *v28 = 0i64;
  v24 = MarshallingContext;
  v10 = Path->Length + 26 + Name->Length;
  pcbInfoBuffer = 0;
  *(_QWORD *)&Destination.Length = 0i64;
  Destination.MaximumLength = v10;
  ImpersonationState = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  Destination.Buffer = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v10, 0x20204D43ui64);
  if( !Destination.Buffer )
    return 3221225626i64;
  *v27 = 0i64;
  *v28 = 0i64;
  RtlAppendUnicodeStringToString(&Destination, (UNICODE_STRING *)&CmpLogPrefix);
  RtlAppendUnicodeStringToString(&Destination, Path);
  RtlAppendUnicodeStringToString(&Destination, Name);
  RtlAppendUnicodeStringToString(&Destination, (UNICODE_STRING *)&CmpLogExt);
  pplfoLog = 0i64;
  ppvMarshalContext = 0i64;
  v11 = PsDisableImpersonation(KeGetCurrentThread(), &ImpersonationState);
  KeStackAttachProcess(PsInitialSystemProcess, &ApcState);
  LogFileInformation = ClfsCreateLogFile(
                         &pplfoLog,
                         &Destination,
                         0xC0010000,
                         0,
                         ContainerSize,
                         1u,
                         8u,
                         0,
                         0x200u,
                         0i64,
                         0);
  if( LogFileInformation < 0 )
  {
    if( LogFileInformation == -1073741772 )
    {
      LogFileInformation = ClfsCreateLogFile(
                             &pplfoLog,
                             &Destination,
                             0xC0010000,
                             0,
                             ContainerSize,
                             2u,
                             8u,
                             0,
                             0x200u,
                             0i64,
                             0);
      if( LogFileInformation >= 0 )
      {
        v15 = 0;
        while( 1 )
        {
          LODWORD(fCreateDisposition) = v15;
          LogFileInformation = CmpAddRemoveContainerToCLFSLog(
                                 pplfoLog,
                                 Path,
                                 Name,
                                 (_UNICODE_STRING *)&CmpLogExt,
                                 (_UNICODE_STRING *)&CmpContainerSuffix,
                                 fCreateDisposition,
                                 pcbContainer,
                                 fFlagsAndAttributes);
          if( LogFileInformation < 0 )
            break;
          if( (unsigned int)++v15 >= 3 )
            goto LABEL_6;
        }
      }
    }
  }
  else
  {
    pcbInfoBuffer = 120;
    PoolWithTag = (CLFS_INFORMATION *)ExAllocatePoolWithTag(PagedPool, 0x78ui64, 0x20204D43ui64);
    v14 = PoolWithTag;
    if( PoolWithTag )
    {
      LogFileInformation = ClfsGetLogFileInformation(pplfoLog, PoolWithTag, &pcbInfoBuffer);
      if( LogFileInformation < 0 )
      {
        ExFreePoolWithTag(v14, 0);
      }
      else
      {
        v15 = *((_DWORD *)v14 + 10);
        ExFreePoolWithTag(v14, 0);
LABEL_6:
        LogFileInformation = ClfsCreateMarshallingArea(
                               pplfoLog,
                               PagedPool,
                               0i64,
                               0i64,
                               0x1000u,
                               2u,
                               0x14u,
                               &ppvMarshalContext);
        if( LogFileInformation >= 0 )
        {
          *(_DWORD *)v24 = v15;
          *v27 = pplfoLog;
          *v28 = ppvMarshalContext;
        }
      }
    }
    else
    {
      LogFileInformation = -1073741670;
    }
  }
  KeUnstackDetachProcess(&ApcState);
  if( v11 )
    PsRestoreImpersonation(KeGetCurrentThread(), &ImpersonationState);
  ExFreePoolWithTag(Destination.Buffer, 0);
  if( LogFileInformation < 0 )
  {
    if( pplfoLog )
      ClfsCloseLogFileObject(pplfoLog);
  }
  return(unsigned int)LogFileInformation;
}

Referenced by: