EtwpQueryPartitionRegistryInformation

INT64 __fastcall EtwpQueryPartitionRegistryInformation(_GUID *a1, PVOID *a2, _WORD *a3, _DWORD *a4, INT64 a5, INT64 a6){
  int v10; 
  ULONG v12; 
  void *PoolWithTag; 
  NTSTATUS v14; 
  UINT64 UnicodeStringByteCount; 
  UINT64 UnicodeStringByteCounta; 
  __int16 v17[2]; 
  ULONG UTF8StringActualByteCount; 
  void *KeyHandle; 
  PCWCH UnicodeStringSource[2]; 
  struct _UNICODE_STRING UnicodeString; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v24; 
  _DWORD *v25; 
  int v26; 
  PCWCH *v27; 
  int v28; 
  struct _UNICODE_STRING *p_UnicodeString; 
  _RTL_QUERY_REGISTRY_TABLE result; 
  INT64(__stdcall *v31)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID); 
  const wchar_t *v32; 
  int *v33; 
  int v34; 
  __int16 *v35; 
  INT64(__stdcall *v36)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID); 
  const wchar_t *v37; 
  int *v38; 
  int v39; 
  __int16 *v40; 
  KeyHandle = 0i64;
  UTF8StringActualByteCount = 0;
  v17[0] = 0;
  *a4 = 0;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  DestinationString = 0i64;
  *(_OWORD *)UnicodeStringSource = 0i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  UnicodeString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control", (WCHAR)a3);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v10 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( v10 >= 0 )
  {
    memset((INT64)&result, 0i64);
    v25 = a4;
    v34 = 1;
    result.QueryRoutine = (int(__fastcall *)(wchar_t *, unsigned int, void *, unsigned int, void *, void *))EtwpQueryRegistryCallback;
    result.EntryContext = &v24;
    v31 = EtwpQueryRegistryCallback;
    result.Name = L"ContainerType";
    v26 = 1;
    result.DefaultType = 4;
    v24 = 4;
    v33 = &v26;
    v32 = L"ContainerId";
    v35 = v17;
    v27 = UnicodeStringSource;
    v38 = &v28;
    v37 = L"ContainerCorrelationId";
    v40 = v17;
    v36 = EtwpQueryRegistryCallback;
    v39 = 1;
    v28 = 1;
    p_UnicodeString = &UnicodeString;
    v10 = RtlQueryRegistryValuesEx(0x40000000ui64, (const WCHAR *)KeyHandle, &result, 0i64, 0i64);
    if( v10 >= 0 )
    {
      *(_QWORD *)a5 = 0i64;
      if( (unsigned int)StringToGuidNoBrackets((UINT16 *)UnicodeStringSource, (INT64)a1) )
        *a1 = NullGuid;
      LODWORD(UnicodeStringByteCount) = LOWORD(UnicodeStringSource[0]);
      if( !RtlUnicodeToUTF8N(
              0i64,
              0i64,
              (UINT64 *)&UTF8StringActualByteCount,
              (PWCHAR)UnicodeStringSource[1],
              UnicodeStringByteCount) )
      {
        v12 = UTF8StringActualByteCount;
        if( UTF8StringActualByteCount < 0xFFFF )
        {
          PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNxCacheAligned, UTF8StringActualByteCount, 0x61777445ui64);
          *a2 = PoolWithTag;
          if( PoolWithTag )
          {
            LODWORD(UnicodeStringByteCounta) = LOWORD(UnicodeStringSource[0]);
            v14 = RtlUnicodeToUTF8N(
                    (PSTR)PoolWithTag,
                    v12,
                    (UINT64 *)&UTF8StringActualByteCount,
                    (PWCHAR)UnicodeStringSource[1],
                    UnicodeStringByteCounta);
            if( !v14 || v14 == 263 )
            {
              *a3 = UTF8StringActualByteCount;
            }
            else
            {
              ExFreePoolWithTag(*a2, 0x61777445u);
              *a2 = 0i64;
            }
          }
        }
      }
      v10 = StringToGuidNoBrackets(&UnicodeString.Length, a6);
      if( v10 )
      {
        v10 = 0;
        *(GUID *)a6 = NullGuid;
      }
    }
  }
  if( KeyHandle )
    ZwClose(KeyHandle);
  RtlFreeAnsiString((_UNICODE_STRING *)UnicodeStringSource);
  RtlFreeAnsiString(&UnicodeString);
  return(unsigned int)v10;
}

Referenced by: