CmpAddRemoveRMLogContainer

__int64 __fastcall CmpAddRemoveRMLogContainer(__int64 a1){
  ULONG_PTR v2; 
  _UNICODE_STRING *p_NameStr; 
  int v4; 
  unsigned int v5; 
  NTSTATUS v6; 
  UINT64 ContainerNum; 
  UINT8 v9; 
  struct _UNICODE_STRING UnicodeString; 
  UNICODE_STRING NameStr; 
  struct _EVENT_DATA_DESCRIPTOR v12; 
  *(_QWORD *)&NameStr.Length = 0i64;
  NameStr.Buffer = 0i64;
  *(_QWORD *)&UnicodeString.Length = 0i64;
  UnicodeString.Buffer = 0i64;
  if( (PVOID)a1 == CmRmSystem )
  {
    v2 = Hive;
    p_NameStr = (_UNICODE_STRING *)&CmpLogPath;
  }
  else
  {
    v4 = CmpQueryNameString(*(PVOID *)(*(_QWORD *)(a1 + 80) + 1536i64), &NameStr);
    if( v4 < 0 )
      goto LABEL_16;
    v2 = *(_QWORD *)(a1 + 80);
    p_NameStr = &NameStr;
  }
  v4 = RtlStringFromGUIDEx((const _GUID *const)(*(_QWORD *)(v2 + 64) + 112i64), &UnicodeString, 1u);
  if( v4 >= 0 )
  {
    v5 = *(_DWORD *)(a1 + 68);
    if( v5 >= 0x100 )
    {
LABEL_10:
      if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 1i64) )
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&dword_140C02130,
          (unsigned __int8 *)&word_140022BB6,
          0i64,
          0i64,
          2u,
          &v12);
      v4 = -1073741670;
    }
    else
    {
      while( 1 )
      {
        LODWORD(ContainerNum) = v5;
        v6 = CmpAddRemoveContainerToCLFSLog(
               *(PVOID *)(a1 + 88),
               p_NameStr,
               &UnicodeString,
               (_UNICODE_STRING *)&CmpLogExt,
               (_UNICODE_STRING *)&CmpContainerSuffix,
               ContainerNum,
               (UINT64 *)(a1 + 72),
               v9);
        v4 = v6;
        if( v6 != -1073741771 && v6 != -1073741635 )
          break;
        if( ++v5 >= 0x100 )
          goto LABEL_10;
      }
      if( v6 >= 0 )
        ++*(_DWORD *)(a1 + 68);
    }
  }
  if( UnicodeString.Buffer )
    RtlFreeAnsiString(&UnicodeString);
LABEL_16:
  if( NameStr.Buffer )
    RtlFreeAnsiString(&NameStr);
  return(unsigned int)v4;
}

Referenced by: