EtwpEnumerateKeyProviders

int __fastcall EtwpEnumerateKeyProviders(
        INT64 a1,
        unsigned int a2,
        const WCHAR *a3,
        INT64 a4,
        unsigned int *KeyInformation,
        __int64 NewElement,
        _RTL_AVL_TABLE *Table,
        INT64 a8){
  INT64 v10; 
  int result; 
  unsigned int v12; 
  int v13; 
  NTSTATUS v14; 
  unsigned __int64 v15; 
  _RTL_AVL_TABLE *v16; 
  const WCHAR *v17; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  NTSTATUS ValueData; 
  int ValueData_4; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 

  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  DestinationString = 0i64;
  LOBYTE(NewElement) = 0;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  RtlInitUnicodeString(&DestinationString, a3);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v10, Length, (INT64)ResultLength, 0i64, 0i64);
  if( result >= 0 )
  {
    v12 = 0;
    v13 = a8;
    do
    {
      LODWORD(Lengtha) = 286;
      v14 = ZwEnumerateKey(KeyHandle, v12, KeyBasicInformation, KeyInformation, Lengtha, (UINT64 *)&ValueData_4);
      v15 = KeyInformation[3];
      if( v15 >= 0x108 )
        v14 = -2147483643;
      if( v14 < 0 )
      {
        if( v14 != -2147483622 )
        {
          ValueData = RtlNtStatusToDosError((unsigned int)v14);
          LODWORD(ResultLengtha) = 4;
          if( a4 )
            v17 = (const WCHAR *)a4;
          else
            v17 = a3;
          RtlWriteRegistryValue(0i64, v17, L"EnableStatus", 4ui64, &ValueData, (UINT64)ResultLengtha);
        }
      }
      else
      {
        v16 = Table;
        *((_WORD *)KeyInformation + (v15 >> 1) + 8) = 0;
        RtlInsertElementGenericTableAvl(v16, KeyInformation + 4, KeyInformation[3] + 2, (UINT8 *)&NewElement);
        if( (_BYTE)NewElement )
        {
          LODWORD(ResultLengtha) = v13;
          EtwpEnableAutoLoggerProvider(a1, a2, (const WCHAR *)KeyInformation + 8, (INT64)a3, a4, (INT64)ResultLengtha);
        }
      }
      ++v12;
    }
    while( v14 >= 0 );
    return ZwClose((_HANDLE)KeyHandle);
  }
  return result;
}

Referenced by: