NTSTATUS __stdcall EtwpQueryPsmKey(VOID *TokenObject, WCHAR *PsmKey, UINT64 *PsmKeySize){
NTSTATUS result;
UINT64 dwFlags;
WCHAR *ppszDestEnd[2];
_PS_PKG_CLAIM PkgClaim;
__int64 v9;
ppszDestEnd[0] = 0i64;
result = RtlpQueryPackageIdentityAttributes(TokenObject, PsmKey, &PkgClaim, 0i64, 0i64);
if( result >= 0 )
{
LODWORD(dwFlags) = 2048;
if( *(_DWORD *)(v9 + 24) <= 2u )
result = RtlStringCbPrintfExW(PsmKey, *PsmKeySize, ppszDestEnd, 0i64, dwFlags, (WCHAR *)L"%wZ%wc%wZ");
else
result = RtlStringCbPrintfExW(PsmKey, *PsmKeySize, ppszDestEnd, 0i64, dwFlags, (WCHAR *)L"%wZ%wc%wZ%wc%wZ");
if( result >= 0 )
*PsmKeySize = (char *)ppszDestEnd[0] - (char *)PsmKey + 2;
}
return result;
}