EtwpQueryPartitionRegistryInformation

__int64 __fastcall EtwpQueryPartitionRegistryInformation(
        GUID *a1,
        PVOID *a2,
        _WORD *a3,
        _DWORD *a4,
        __int64 a5,
        INT64 a6){
  INT64 v10; 
  NTSTATUS RegistryValues; 
  unsigned int v13; 
  VOID **PoolWithTag; 
  NTSTATUS v15; 
  VOID *Environment; 
  VOID *Environmenta; 
  VOID *Environmentb; 
  INT64 v19; 
  INT64 v20; 
  VOID *KeyHandle; 
  UINT16 v22[8]; 
  UINT16 v23[8]; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v26; 
  _DWORD *v27; 
  int v28; 
  UINT16 *v29; 
  int v30; 
  UINT16 *v31; 
  _RTL_QUERY_REGISTRY_TABLE QueryTable[4]; 

  KeyHandle = 0i64;
  HIDWORD(v20) = 0;
  LOWORD(v20) = 0;
  *a4 = 0;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  DestinationString = 0i64;
  *(_OWORD *)v22 = 0i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  *(_OWORD *)v23 = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  RegistryValues = ZwOpenKey(
                     &KeyHandle,
                     0x20019ui64,
                     &ObjectAttributes,
                     v10,
                     (INT64)Environment,
                     v19,
                     v20,
                     (INT64)KeyHandle);
  if( RegistryValues >= 0 )
  {
    memset(QueryTable, 0i64, sizeof(QueryTable));
    v27 = a4;
    QueryTable[1].DefaultType = 1;
    QueryTable[0].QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))EtwpQueryRegistryCallback;
    QueryTable[0].EntryContext = &v26;
    QueryTable[1].QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))EtwpQueryRegistryCallback;
    QueryTable[0].Name = L"ContainerType";
    v28 = 1;
    QueryTable[0].DefaultType = 4;
    v26 = 4;
    QueryTable[1].EntryContext = &v28;
    QueryTable[1].Name = L"ContainerId";
    QueryTable[1].DefaultData = &v20;
    v29 = v22;
    QueryTable[2].EntryContext = &v30;
    QueryTable[2].Name = L"ContainerCorrelationId";
    QueryTable[2].DefaultData = &v20;
    QueryTable[2].QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))EtwpQueryRegistryCallback;
    QueryTable[2].DefaultType = 1;
    v30 = 1;
    v31 = v23;
    RegistryValues = RtlQueryRegistryValuesEx(0x40000000ui64, (const WCHAR *)KeyHandle, QueryTable, 0i64, 0i64);
    if( RegistryValues >= 0 )
    {
      *(_QWORD *)a5 = 0i64;
      if( StringToGuidNoBrackets(v22, (INT64)a1) )
        *a1 = NullGuid;
      LODWORD(Environmenta) = v22[0];
      if( !RtlUnicodeToUTF8N(0i64, 0i64, (PULONG)&v20 + 1, *(WCHAR **)&v22[4], (UINT64)Environmenta) )
      {
        v13 = HIDWORD(v20);
        if( HIDWORD(v20) < 0xFFFF )
        {
          PoolWithTag = ExAllocatePoolWithTag(0x204ui64, HIDWORD(v20), 1635218501i64);
          *a2 = PoolWithTag;
          if( PoolWithTag )
          {
            LODWORD(Environmentb) = v22[0];
            v15 = RtlUnicodeToUTF8N((PCHAR)PoolWithTag, v13, (PULONG)&v20 + 1, *(WCHAR **)&v22[4], (UINT64)Environmentb);
            if( !v15 || v15 == 263 )
            {
              *a3 = WORD2(v20);
            }
            else
            {
              ExFreePoolWithTag(*a2, 0x61777445u);
              *a2 = 0i64;
            }
          }
        }
      }
      RegistryValues = StringToGuidNoBrackets(v23, a6);
      if( RegistryValues )
      {
        RegistryValues = 0;
        *(GUID *)a6 = NullGuid;
      }
    }
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  RtlFreeAnsiString((_UNICODE_STRING *)v22);
  RtlFreeAnsiString((_UNICODE_STRING *)v23);
  return(unsigned int)RegistryValues;
}

Referenced by: