EtwpReadPerSiloConfigParameters

NTSTATUS __fastcall EtwpReadPerSiloConfigParameters(__int64 a1, __int64 a2, WCHAR a3){
  INT64 v4; 
  NTSTATUS result; 
  VOID *v6; 
  INT64 v7; 
  INT64 v8; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v11; 
  unsigned int *v12; 
  _RTL_QUERY_REGISTRY_TABLE QueryTable[2]; 
  unsigned int v14; 
  VOID *KeyHandle; 

  KeyHandle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v14 = 64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(
         &KeyHandle,
         0x20019ui64,
         &ObjectAttributes,
         v4,
         v7,
         v8,
         *(INT64 *)&DestinationString.Length,
         (INT64)DestinationString.Buffer) < 0
    || (memset(QueryTable, 0i64, sizeof(QueryTable)),
        QueryTable[0].QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))EtwpQueryRegistryCallback,
        QueryTable[0].EntryContext = &v11,
        QueryTable[0].Name = L"EtwMaxLoggers",
        QueryTable[0].DefaultType = 4,
        v11 = 4,
        v12 = &v14,
        RtlQueryRegistryValuesEx(0x40000000ui64, (const WCHAR *)KeyHandle, QueryTable, 0i64, 0i64) < 0) )
  {
    result = v14;
  }
  else
  {
    result = 256;
    if( v14 <= 0x100 )
    {
      result = v14;
      if( v14 < 0x20 )
        result = 32;
    }
    v14 = result;
  }
  v6 = KeyHandle;
  *(_DWORD *)(a1 + 16) = result;
  if( v6 )
    return ZwClose((_HANDLE)v6);
  return result;
}

Referenced by: