VrpRegistryCallback

NTSTATUS __fastcall VrpRegistryCallback(VOID *a1, VOID *a2, VOID *a3){
  NTSTATUS v3; 
  int v5; 
  _VRP_JOB_CONTEXT *v7; 
  _UNICODE_STRING *v8; 
  _VRP_JOB_CONTEXT *JobContext; 
  __int64 v11; 
  _LPGUID ActivityId[4]; 

  v3 = 0;
  JobContext = 0i64;
  v11 = 0i64;
  v5 = (int)a2;
  *(_OWORD *)ActivityId = 0i64;
  if( (unsigned int)a2 <= 0x31 && VrpShouldOperateOnCall((int)a2, a3, &v11, &JobContext) )
  {
    EtwActivityIdControl(1ui64, (_GUID *)ActivityId);
    switch( v5 )
    {
      case 29:
        return VrpPostOpenOrCreate((_REG_POST_OPERATION_INFORMATION *)a3);
      case 28:
        return VrpPreOpenOrCreate((_REG_CREATE_KEY_INFORMATION_V1 *)a3, JobContext);
      case 22:
        return VrpPostQueryKey((_REG_POST_OPERATION_INFORMATION *)a3, v7);
      default:
        if( v5 != 7 )
        {
          switch( v5 )
          {
            case 14:
              v8 = (_UNICODE_STRING *)*((_QWORD *)a3 + 2);
              if( v8 )
                VrpDecommissionKeyContext(v8);
              break;
            case 20:
              v3 = VrpPostEnumerateKey((_REG_POST_OPERATION_INFORMATION *)a3, JobContext);
              break;
            case 26:
              return VrpPreOpenOrCreate((_REG_CREATE_KEY_INFORMATION_V1 *)a3, JobContext);
            case 27:
              return VrpPostOpenOrCreate((_REG_POST_OPERATION_INFORMATION *)a3);
            case 30:
              return VrpPreFlushKey((_VRP_JOB_CONTEXT *)0x140000000i64);
            case 32:
              return VrpPreLoadKey((_REG_LOAD_KEY_INFORMATION *)a3, JobContext);
            case 34:
              return VrpPreUnloadKey((INT64)a3, (UINT64 *)JobContext);
            case 35:
              return VrpPostUnloadKey((INT64)a3, (INT64)JobContext);
            case 40:
              VrpFreeKeyContext(*((VOID **)a3 + 1));
              break;
            case 47:
              return VrpPreQueryKeyName((_REG_QUERY_KEY_NAME *)a3, v7);
            default:
              return v3;
          }
        }
        break;
    }
  }
  return v3;
}

Referenced by: