EtwpReadConfigParameters

VOID __stdcall EtwpReadConfigParameters(){
  WCHAR *v0; 
  INT64 v1; 
  int v2; 
  int v3; 
  VOID **PoolWithTag; 
  unsigned __int64 v5; 
  VOID *Environment; 
  INT64 v7; 
  unsigned int v8; 
  unsigned int v9; 
  INT64 v10; 
  _UNICODE_STRING v11; 
  VOID *DestinationString[3]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v14; 
  _UNICODE_STRING *v15; 
  int v16; 
  unsigned int *v17; 
  int v18; 
  unsigned int *v19; 
  _RTL_QUERY_REGISTRY_TABLE QueryTable[4]; 

  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  memset(DestinationString, 0, sizeof(DestinationString));
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  LOWORD(v10) = 0;
  v0 = 0i64;
  v11 = 0i64;
  RtlInitUnicodeString(
    (PUNICODE_STRING)&DestinationString[1],
    L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(DestinationString, 0x20019ui64, &ObjectAttributes, v1, (INT64)Environment, v7, 10i64, v10) < 0 )
    goto LABEL_21;
  memset(QueryTable, 0i64, sizeof(QueryTable));
  QueryTable[0].QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))EtwpQueryRegistryCallback;
  QueryTable[1].QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))EtwpQueryRegistryCallback;
  QueryTable[0].EntryContext = &v14;
  QueryTable[2].QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))EtwpQueryRegistryCallback;
  QueryTable[0].Name = L"RTBacklogRoot";
  QueryTable[0].DefaultType = 1;
  QueryTable[0].DefaultData = &v10;
  v14 = 1;
  v15 = &v11;
  QueryTable[1].EntryContext = &v16;
  QueryTable[1].Name = L"MaxNonPagedPoolUsage";
  v17 = &v8;
  QueryTable[2].EntryContext = &v18;
  QueryTable[2].Name = L"StackCaptureTimeout";
  v19 = &v9;
  QueryTable[1].DefaultType = 4;
  v16 = 4;
  QueryTable[2].DefaultType = 4;
  v18 = 4;
  if( RtlQueryRegistryValuesEx(0x40000000ui64, (const WCHAR *)DestinationString[0], QueryTable, 0i64, 0i64) < 0 )
  {
LABEL_21:
    v2 = v8;
    v3 = v9;
  }
  else
  {
    if( v11.Buffer )
    {
      if( v11.Length >= 4u )
      {
        PoolWithTag = ExAllocatePoolWithTag(1ui64, v11.MaximumLength + 2i64, 1350005829i64);
        v0 = (WCHAR *)PoolWithTag;
        if( PoolWithTag )
        {
          memmove(PoolWithTag, v11.Buffer, v11.MaximumLength);
          v5 = (unsigned __int64)v11.Length >> 1;
          if( v0[v5 - 1] != 92 )
          {
            v0[v5] = 92;
            v0[((unsigned __int64)v11.Length >> 1) + 1] = 0;
          }
        }
      }
    }
    v2 = 50;
    if( v8 <= 0x32 )
    {
      v2 = v8;
      if( v8 < 0xA )
        v2 = 10;
    }
    v3 = v9;
    v8 = v2;
    if( v9 > 0x2BF20 )
      v3 = 180000;
    v9 = v3;
  }
  EtwpMaxNonPagedPoolUsage = v2;
  if( v0 )
    EtwpRTBacklogFileRoot = v0;
  if( v3 )
    EtwpStackCaptureTimeout = v3;
  if( DestinationString[0] )
    ZwClose((_HANDLE)DestinationString[0]);
  RtlFreeAnsiString(&v11);
}

Referenced by: