PerfDiagpIsTracingAllowed

UINT64 __stdcall PerfDiagpIsTracingAllowed(){
  unsigned int v0; 
  INT64 v1; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v6; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING ValueName; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyValueInformation[4]; 
  int v12; 
  int v13; 
  int v14; 

  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  v0 = 1;
  DestinationString = 0i64;
  ValueName = 0i64;
  RtlInitUnicodeString(
    &DestinationString,
    L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Diagnostics\\Performance");
  RtlInitUnicodeString(&ValueName, L"DisableDiagnosticTracing");
  LODWORD(v6) = 24;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v1, Length, (INT64)ResultLength, v6, 0i64) >= 0 )
  {
    LODWORD(Lengtha) = v6;
    if( ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, KeyValueInformation, Lengtha, &v6) >= 0
      && (unsigned int)v6 >= 0x10
      && v12 == 4
      && v13 == 4
      && v14 )
    {
      v0 = 0;
    }
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return v0;
}

Referenced by: