EtwpQueryRegistryCallback

INT64 __stdcall EtwpQueryRegistryCallback(
        WCHAR *ValueName,
        UINT64 ValueType,
        PVOID ValueData,
        UINT64 ValueLength,
        PVOID Context,
        PVOID EntryContext){
  unsigned int v6; 
  int v7; 
  UNICODE_STRING *v9; 
  __int64 v10; 
  v6 = 0;
  v7 = ValueLength;
  if( EntryContext )
  {
    if( ValueData && (_DWORD)ValueLength )
    {
      if( (_DWORD)ValueType == *(_DWORD *)EntryContext )
      {
        switch( (_DWORD)ValueType )
        {
          case 4:
            if( (unsigned int)ValueLength >= 4 )
              **((_DWORD **)EntryContext + 1) = *(_DWORD *)ValueData;
            break;
          case 0xB:
            **((_QWORD **)EntryContext + 1) = *(_QWORD *)ValueData;
            break;
          case 1:
            v9 = (UNICODE_STRING *)*((_QWORD *)EntryContext + 1);
            if( (unsigned int)ValueLength > 2 )
            {
              if( !RtlCreateUnicodeString(v9, (PWCHAR)ValueData) )
                return(unsigned int)-1073741801;
            }
            else
            {
              *v9 = 0i64;
            }
            break;
          default:
            if( (_DWORD)ValueType == 3 && (unsigned int)ValueLength >= 4 )
            {
              v10 = *((_QWORD *)EntryContext + 1);
              if( (unsigned int)ValueLength > *(_DWORD *)v10 )
              {
                *(_DWORD *)v10 = 0;
                return(unsigned int)-1073741306;
              }
              else
              {
                memmove(*(UINT8 **)(v10 + 8), (UINT8 *)ValueData, (unsigned int)ValueLength);
                **((_DWORD **)EntryContext + 1) = v7;
              }
            }
            break;
        }
      }
      else
      {
        return(unsigned int)-1073741821;
      }
    }
    else if( (_DWORD)ValueType == 3 && *(_DWORD *)EntryContext == 3 )
    {
      **((_DWORD **)EntryContext + 1) = 0;
    }
  }
  return v6;
}

Referenced by: