EtwpQueryRegistryCallback

NTSTATUS __stdcall EtwpQueryRegistryCallback(
        WCHAR *ValueName,
        UINT64 ValueType,
        VOID *ValueData,
        UINT64 ValueLength,
        VOID *Context,
        VOID *EntryContext){
  NTSTATUS v6; 
  int v7; 
  _OWORD *v9; 
  __int64 v10; 

  v6 = 0;
  v7 = ValueLength;
  if( EntryContext )
  {
    if( ValueData && (_DWORD)ValueLength )
    {
      if( (_DWORD)ValueType == *(_DWORD *)EntryContext )
      {
        switch( (_DWORD)ValueType )
        {
          case 4:
            if( (unsigned int)ValueLength >= 4 )
              **((_DWORD **)EntryContext + 1) = *(_DWORD *)ValueData;
            break;
          case 0xB:
            **((_QWORD **)EntryContext + 1) = *(_QWORD *)ValueData;
            break;
          case 1:
            v9 = (_OWORD *)*((_QWORD *)EntryContext + 1);
            if( (unsigned int)ValueLength > 2 )
            {
              if( !RtlCreateUnicodeString((INT64)v9, (INT8 *)ValueData) )
                return -1073741801;
            }
            else
            {
              *v9 = 0i64;
            }
            break;
          default:
            if( (_DWORD)ValueType == 3 && (unsigned int)ValueLength >= 4 )
            {
              v10 = *((_QWORD *)EntryContext + 1);
              if( (unsigned int)ValueLength > *(_DWORD *)v10 )
              {
                *(_DWORD *)v10 = 0;
                return -1073741306;
              }
              else
              {
                memmove(*(VOID **)(v10 + 8), ValueData, ValueLength);
                **((_DWORD **)EntryContext + 1) = v7;
              }
            }
            break;
        }
      }
      else
      {
        return -1073741821;
      }
    }
    else if( (_DWORD)ValueType == 3 && *(_DWORD *)EntryContext == 3 )
    {
      **((_DWORD **)EntryContext + 1) = 0;
    }
  }
  return v6;
}

Referenced by: