VrpRegistryCallback

INT64 __fastcall VrpRegistryCallback(VOID *a1, VOID *a2, VOID *r8_0){
  unsigned int v3; 
  int v5; 
  UNICODE_STRING *v7; 
  UINT64 a4; 
  __int64 a3; 
  GUID ActivityId; 
  v3 = 0;
  a4 = 0i64;
  a3 = 0i64;
  v5 = (int)a2;
  ActivityId = 0i64;
  if( (unsigned int)a2 <= 0x31 && (unsigned int)VrpShouldOperateOnCall((unsigned int)a2, r8_0, &a3, &a4) )
  {
    EtwActivityIdControl(1u, &ActivityId);
    switch( v5 )
    {
      case 29:
        return(unsigned int)VrpPostOpenOrCreate((_REG_POST_OPERATION_INFORMATION *)r8_0);
      case 28:
        return(unsigned int)VrpPreOpenOrCreate((INT64)r8_0, (CHAR *)a4);
      case 22:
        return(unsigned int)VrpPostQueryKey((INT64)r8_0);
      default:
        if( v5 != 7 )
        {
          switch( v5 )
          {
            case 14:
              v7 = (UNICODE_STRING *)*((_QWORD *)r8_0 + 2);
              if( v7 )
                VrpDecommissionKeyContext(v7);
              break;
            case 20:
              v3 = VrpPostEnumerateKey((INT64)r8_0, (UINT64 *)a4);
              break;
            case 26:
              return(unsigned int)VrpPreOpenOrCreate((INT64)r8_0, (CHAR *)a4);
            case 27:
              return(unsigned int)VrpPostOpenOrCreate((_REG_POST_OPERATION_INFORMATION *)r8_0);
            case 30:
              return(unsigned int)VrpPreFlushKey(0.0, a4);
            case 32:
              return(unsigned int)VrpPreLoadKey(r8_0, a4);
            case 34:
              return(unsigned int)VrpPreUnloadKey((INT64)r8_0, (UINT64 *)a4);
            case 35:
              return(unsigned int)VrpPostUnloadKey((INT64)r8_0, a4);
            case 40:
              VrpFreeKeyContext(*((PVOID *)r8_0 + 1));
              break;
            case 47:
              return(unsigned int)VrpPreQueryKeyName((REG_QUERY_KEY_NAME *)r8_0);
            default:
              return v3;
          }
        }
        break;
    }
  }
  return v3;
}

Referenced by: