EtwpInitializeAutoLoggers

VOID __stdcall EtwpInitializeAutoLoggers(){
  __int128 v0; 
  __int128 v1; 
  __int128 v2; 
  __int128 v3; 
  __int128 v4; 
  __int128 v5; 
  int v6; 
  __int128 v7; 
  __int128 v8; 
  __int128 v9; 
  __int128 v10; 
  __int128 v11; 
  __int128 v12; 
  __int128 v13; 
  __int64 v14; 
  RTL_AVL_TABLE *v15; 
  void *PoolWithTag; 
  void *v17; 
  UINT64 v18; 
  UINT64 v19; 
  UINT64 v20[2]; 
  struct _RTL_AVL_TABLE Table; 
  WCHAR SourceString[16]; 
  __int128 Path[8]; 
  int v24; 
  WCHAR LoggerKeyName[8]; 
  __int128 v26; 
  __int128 v27; 
  __int128 v28; 
  __int128 v29; 
  __int128 v30; 
  __int128 v31; 
  __int128 v32; 
  __int64 v33; 
  v0 = *(_OWORD *)L"y\\Machine\\System\\CurrentControlSet\\Control\\WMI\\AutoLogger";
  Path[0] = *(_OWORD *)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI\\AutoLogger";
  v1 = *(_OWORD *)L"e\\System\\CurrentControlSet\\Control\\WMI\\AutoLogger";
  Path[1] = v0;
  v2 = *(_OWORD *)L"\\CurrentControlSet\\Control\\WMI\\AutoLogger";
  Path[2] = v1;
  v3 = *(_OWORD *)L"ControlSet\\Control\\WMI\\AutoLogger";
  Path[3] = v2;
  v4 = *(_OWORD *)L"et\\Control\\WMI\\AutoLogger";
  Path[4] = v3;
  v5 = *(_OWORD *)L"ol\\WMI\\AutoLogger";
  Path[5] = v4;
  Path[6] = v5;
  v6 = *(_DWORD *)L"r";
  Path[7] = *(_OWORD *)L"utoLogger";
  v24 = v6;
  v7 = *(_OWORD *)L"y\\Machine\\System\\CurrentControlSet\\Control\\WMI\\GlobalLogger";
  *(_OWORD *)LoggerKeyName = *(_OWORD *)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI\\GlobalLogger";
  v8 = *(_OWORD *)L"e\\System\\CurrentControlSet\\Control\\WMI\\GlobalLogger";
  v26 = v7;
  v9 = *(_OWORD *)L"\\CurrentControlSet\\Control\\WMI\\GlobalLogger";
  v27 = v8;
  v10 = *(_OWORD *)L"ControlSet\\Control\\WMI\\GlobalLogger";
  v28 = v9;
  v11 = *(_OWORD *)L"et\\Control\\WMI\\GlobalLogger";
  v29 = v10;
  v12 = *(_OWORD *)L"ol\\WMI\\GlobalLogger";
  v30 = v11;
  v13 = *(_OWORD *)L"lobalLogger";
  v14 = *(_QWORD *)L"ger";
  v31 = v12;
  v32 = v13;
  v33 = v14;
  wcscpy(SourceString, L"GlobalLogger");
  memset((INT64)&Table, 0i64);
  RtlInitializeGenericTableAvl(
    &Table,
    (PRTL_AVL_COMPARE_ROUTINE)EtwpAvlCompareKeyNames,
    EtwpAllocateKeyNameEntry,
    EtwpFreeKeyNameEntry,
    0i64);
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x1FEui64, 0x74777445ui64);
  if( !PoolWithTag )
    goto LABEL_10;
  LODWORD(v18) = 510;
  if( (unsigned int)RtlGetPersistedStateLocation(
                       (WCHAR *)L"ETWAutoLoggerPath",
                       0i64,
                       0i64,
                       0i64,
                       PoolWithTag,
                       v18,
                       v20) )
  {
    ExFreePoolWithTag(PoolWithTag, 0x74777445u);
    PoolWithTag = 0i64;
  }
  v17 = ExAllocatePoolWithTag(PagedPool, 0x1FEui64, 0x74777445ui64);
  if( v17 )
  {
    LODWORD(v19) = 510;
    if( (unsigned int)RtlGetPersistedStateLocation((WCHAR *)L"ETWGlobalLoggerPath", 0i64, 0i64, 0i64, v17, v19, v20) )
    {
      ExFreePoolWithTag(v17, 0x74777445u);
      v17 = 0i64;
    }
    EtwStartAutoLogger(SourceString, LoggerKeyName, (UINT64 *)v17);
    EtwpEnumerateAutologgerPath((PCWSTR)Path);
    if( !PoolWithTag )
      goto LABEL_8;
    EtwpEnumerateAutologgerPath((PCWSTR)PoolWithTag);
  }
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x74777445u);
LABEL_8:
  if( v17 )
    ExFreePoolWithTag(v17, 0x74777445u);
LABEL_10:
  EtwpFreeKeyNameList(&Table, v15);
}

Referenced by: