EtwpGetGuidSecurityDescriptor

NTSTATUS __stdcall EtwpGetGuidSecurityDescriptor(_UNICODE_STRING *GuidName, VOID **SecurityDescriptor){
  VOID **ValueData; 
  UINT64 v3; 
  NTSTATUS v6; 
  NTSTATUS v7; 
  VOID **PoolWithTag; 
  UINT64 Length; 
  unsigned int ValueType; 

  ValueData = 0i64;
  v3 = 512i64;
  ValueType = 0;
  *SecurityDescriptor = 0i64;
  LODWORD(Length) = 512;
  while( 1 )
  {
    if( ValueData )
      ExFreePoolWithTag(ValueData, 0);
    ValueData = ExAllocatePoolWithTag(1ui64, (unsigned int)v3, 1350005829i64);
    if( !ValueData )
      break;
    v6 = RtlQueryRegistryValueWithFallback(
           *(&ExBootDevicesRemovedEvent + 310),
           *(&ExBootDevicesRemovedEvent + 308),
           GuidName,
           v3,
           &ValueType,
           ValueData,
           (PULONG)&Length);
    v7 = v6;
    if( v6 != -2147483643 && v6 != -1073741789 )
    {
      v3 = (unsigned int)Length;
      goto LABEL_8;
    }
    v3 = (unsigned int)Length;
  }
  v7 = -1073741670;
LABEL_8:
  if( v7 >= 0 && ValueType == 3 )
  {
    if( SeValidSecurityDescriptor((unsigned int)v3, (INT64)ValueData) )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, v3, 1350005829i64);
      *SecurityDescriptor = PoolWithTag;
      if( PoolWithTag )
        memmove(PoolWithTag, ValueData, v3);
      else
        v7 = -1073741670;
    }
    else
    {
      v7 = -1073741703;
    }
  }
  if( ValueData )
    ExFreePoolWithTag(ValueData, 0);
  return v7;
}

Referenced by: