EtwpRegTraceCallback
INT8 __stdcall EtwpRegTraceCallback(PVOID CallbackContext, PVOID Argument1, PVOID Argument2){
char v4;
_DWORD *v5;
unsigned __int16 *v6;
unsigned int v7;
unsigned __int16 *v8;
UINT16 v9;
int v10;
int v11;
int v12;
int v13;
int v14;
int v15;
int v16;
__int128 v17;
__int64 v18;
PVOID v19;
UINT64 v20;
__int64 v21;
VOID *v22;
__int64 v23;
__int64 v24;
UINT64 v25;
PVOID *v26;
__int128 v27;
int v28;
int v29;
int v30;
int v31;
int v32;
int v33;
unsigned __int16 **v34;
__int64 v35;
__int64 v36;
PVOID v37;
_DWORD *v38;
char v39;
__int64 *v40;
__int64 *v41;
__int64 v42;
__int64 v43;
__int64 v44;
__int64 v45;
unsigned __int64 v46;
unsigned int v47;
__int64 v48;
__int64 v49;
unsigned int v50;
unsigned __int64 v51;
unsigned int v52;
__int64 v53;
__int64 v54;
__int64 v55;
__int64 v56;
unsigned int v57;
__int64 v58;
__int64 v59;
unsigned int v60;
__int64 v61;
__int64 v62;
bool v63;
union _LARGE_INTEGER *UserData;
void *v66;
int v67;
unsigned __int16 v68;
__int64 v69;
PVOID Object;
__int64 v71;
PVOID P;
int v73;
int v74;
__int64 v75;
PVOID v76;
_QWORD ObjectName[4];
EVENT_DATA_DESCRIPTOR v78;
__int64 v79[2];
char v80;
memset(ObjectName, 0, 24);
v4 = 0;
v5 = 0i64;
v73 = 0;
v6 = 0i64;
v71 = 0i64;
LODWORD(v69) = 0;
v7 = 3;
Object = 0i64;
v8 = 0i64;
v76 = 0i64;
v9 = 0;
P = 0i64;
LODWORD(v75) = 0;
v74 = 0;
LOWORD(v67) = 0;
v68 = 0;
if( (int)Argument1 > 22 )
{
v28 = (_DWORD)Argument1 - 23;
if( !v28 )
{
v21 = (__int64)Argument2;
v36 = *((_QWORD *)Argument2 + 2);
v4 = 113;
v37 = *(PVOID *)Argument2;
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_QUERY_VALUE_KEY;
v8 = *(unsigned __int16 **)(v36 + 8);
Object = v37;
LODWORD(v71) = *(_DWORD *)(v36 + 16);
v38 = *(_DWORD **)(v36 + 40);
v20 = (unsigned int)*v38;
LODWORD(v69) = *v38;
if( (EtwpRegTraceOptions & 2) == 0 || *((int *)Argument2 + 2) < 0 )
goto LABEL_53;
v22 = *(VOID **)(v36 + 24);
LABEL_52:
LOWORD(v67) = EtwpCaptureRegistryData(&P, v22, v20);
v9 = v67;
goto LABEL_53;
}
v29 = v28 - 1;
if( !v29 )
{
v35 = *((_QWORD *)Argument2 + 2);
v21 = (__int64)Argument2;
v4 = 40;
Object = *(PVOID *)Argument2;
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_QUERY_MULTIPLE_VALUE_KEY;
HIDWORD(v71) = *(_DWORD *)(v35 + 16);
LODWORD(v69) = **(_DWORD **)(v35 + 32);
goto LABEL_53;
}
v30 = v29 - 3;
if( v30 )
{
v31 = v30 - 2;
if( v31 )
{
v32 = v31 - 2;
if( v32 )
{
v33 = v32 - 6;
if( v33 )
{
if( v33 != 2 )
return 0;
v27 = ETW_REGISTRY_EVENT_SET_SECURITY_KEY;
}
else
{
v27 = ETW_REGISTRY_EVENT_QUERY_SECURITY_KEY;
}
}
else
{
v27 = ETW_REGISTRY_EVENT_FLUSH_KEY;
}
v21 = (__int64)Argument2;
goto LABEL_41;
}
v21 = (__int64)Argument2;
v34 = (unsigned __int16 **)*((_QWORD *)Argument2 + 2);
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_OPEN_KEY;
Object = v34[1];
if( *((int *)Argument2 + 2) >= 0 )
goto LABEL_46;
}
else
{
v21 = (__int64)Argument2;
v34 = (unsigned __int16 **)*((_QWORD *)Argument2 + 2);
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_CREATE_KEY;
Object = v34[1];
if( *((int *)Argument2 + 2) >= 0 )
{
v73 = *(_DWORD *)v34[8];
LABEL_46:
v76 = *(PVOID *)Argument2;
}
}
v8 = *v34;
v4 = 7;
goto LABEL_53;
}
if( (_DWORD)Argument1 == 22 )
{
v18 = *((_QWORD *)Argument2 + 2);
Object = *(PVOID *)Argument2;
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_QUERY_KEY;
LODWORD(v71) = *(_DWORD *)(v18 + 8);
v20 = **(unsigned int **)(v18 + 32);
goto LABEL_18;
}
v10 = (_DWORD)Argument1 - 1;
if( v10 )
{
v11 = v10 - 13;
if( v11 )
{
v12 = v11 - 1;
if( !v12 )
{
v26 = (PVOID *)*((_QWORD *)Argument2 + 2);
v21 = (__int64)Argument2;
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_DELETE_KEY;
Object = *v26;
goto LABEL_53;
}
v13 = v12 - 1;
if( !v13 )
{
v21 = (__int64)Argument2;
v24 = *((_QWORD *)Argument2 + 2);
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_SET_VALUE_KEY;
v8 = *(unsigned __int16 **)(v24 + 8);
LODWORD(v71) = *(_DWORD *)(v24 + 20);
Object = *(PVOID *)Argument2;
v25 = *(unsigned int *)(v24 + 32);
LODWORD(v69) = *(_DWORD *)(v24 + 32);
if( (EtwpRegTraceOptions & 2) != 0 && *((int *)Argument2 + 2) >= 0 )
{
v9 = EtwpCaptureRegistryData(&P, *(VOID **)(v24 + 24), v25);
LOWORD(v67) = v9;
}
v5 = (_DWORD *)*((_QWORD *)Argument2 + 4);
v4 = -15;
goto LABEL_53;
}
v14 = v13 - 1;
if( v14 )
{
v15 = v14 - 1;
if( v15 )
{
v16 = v15 - 2;
if( v16 )
{
if( v16 != 1 )
return 0;
v17 = ETW_REGISTRY_EVENT_ENUMERATE_VALUE_KEY;
}
else
{
v17 = ETW_REGISTRY_EVENT_ENUMERATE_KEY;
}
v18 = *((_QWORD *)Argument2 + 2);
v4 = 120;
v19 = *(PVOID *)Argument2;
*(_OWORD *)&ObjectName[1] = v17;
Object = v19;
HIDWORD(v71) = *(_DWORD *)(v18 + 8);
LODWORD(v71) = *(_DWORD *)(v18 + 12);
v20 = **(unsigned int **)(v18 + 32);
goto LABEL_13;
}
v18 = *((_QWORD *)Argument2 + 2);
Object = *(PVOID *)Argument2;
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_SET_INFORMATION_KEY;
LODWORD(v71) = *(_DWORD *)(v18 + 8);
v20 = *(unsigned int *)(v18 + 24);
LABEL_18:
v4 = 112;
LABEL_13:
v21 = (__int64)Argument2;
LODWORD(v69) = v20;
if( (EtwpRegTraceOptions & 2) == 0 || *((int *)Argument2 + 2) < 0 )
goto LABEL_53;
v22 = *(VOID **)(v18 + 16);
goto LABEL_52;
}
v23 = *((_QWORD *)Argument2 + 2);
v21 = (__int64)Argument2;
v4 = 1;
*(_OWORD *)&ObjectName[1] = ETW_REGISTRY_EVENT_DELETE_VALUE_KEY;
v8 = *(unsigned __int16 **)(v23 + 8);
LABEL_20:
Object = *(PVOID *)Argument2;
LABEL_53:
if( (EtwpRegTraceOptions & 1) != 0 )
{
v39 = 1;
if( Object )
{
CmCallbackGetKeyObjectID(
(PEX_CALLBACK_FUNCTION)&EtwpRegTraceCookie,
(PCUNICODE_STRING)Object,
0i64,
ObjectName,
UserData,
v66);
v9 = v67;
v6 = (unsigned __int16 *)ObjectName[0];
}
}
else
{
v39 = 0;
}
v78.Ptr = (unsigned __int64)&Object;
*(_QWORD *)&v78.Size = 8i64;
if( (v4 & 4) != 0 )
{
v79[1] = 8i64;
v79[0] = (__int64)&v76;
v40 = (__int64 *)&v80;
}
else
{
v7 = 2;
v40 = v79;
}
v41 = &EtwpNull;
if( v21 != 1 )
v41 = (__int64 *)(v21 + 8);
*v40 = (__int64)v41;
v40[1] = 4i64;
if( (v4 & 8) != 0 )
{
v42 = 2i64 * v7++;
*(&v78.Ptr + v42) = (unsigned __int64)&v71 + 4;
*((_QWORD *)&v78.Size + v42) = 4i64;
}
if( (v4 & 0x10) != 0 )
{
v43 = 2i64 * v7++;
*(&v78.Ptr + v43) = (unsigned __int64)&v71;
*((_QWORD *)&v78.Size + v43) = 4i64;
}
if( (v4 & 2) != 0 )
{
v44 = 2i64 * v7++;
*(&v78.Ptr + v44) = (unsigned __int64)&v73;
*((_QWORD *)&v78.Size + v44) = 4i64;
}
if( (v4 & 0x20) != 0 )
{
v45 = 2i64 * v7++;
*(&v78.Ptr + v45) = (unsigned __int64)&v69;
*((_QWORD *)&v78.Size + v45) = 4i64;
}
if( v39 == 1 )
{
if( v6 )
{
v46 = *((_QWORD *)v6 + 1);
if( v46 )
{
v47 = *v6;
if( (_WORD)v47 )
{
v48 = 2i64 * v7;
*(&v78.Ptr + v48) = v46;
*(&v78.Reserved + 2 * v48) = 0;
++v7;
*(&v78.Size + 2 * v48) = v47;
}
}
}
}
v49 = 2i64 * v7;
v50 = v7 + 1;
*(&v78.Ptr + v49) = (unsigned __int64)&EtwpNull;
*((_QWORD *)&v78.Size + v49) = 2i64;
if( (v4 & 1) != 0 )
{
if( v8 )
{
v51 = *((_QWORD *)v8 + 1);
if( v51 )
{
v52 = *v8;
if( (_WORD)v52 )
{
v53 = 2i64 * v50;
*(&v78.Size + 2 * v53) = v52;
*(&v78.Reserved + 2 * v53) = 0;
++v50;
*(&v78.Ptr + v53) = v51;
}
}
}
v54 = 2i64 * v50++;
*(&v78.Ptr + v54) = (unsigned __int64)&EtwpNull;
*((_QWORD *)&v78.Size + v54) = 2i64;
}
if( (v4 & 0x40) != 0 )
{
v55 = 2i64 * v50++;
*(&v78.Ptr + v55) = (unsigned __int64)&v67;
*((_QWORD *)&v78.Size + v55) = 2i64;
if( v9 )
{
v56 = 2i64 * v50++;
*(&v78.Ptr + v56) = (unsigned __int64)P;
*(&v78.Size + 2 * v56) = v9;
*(&v78.Reserved + 2 * v56) = 0;
}
}
if( v4 < 0 )
{
if( v5 )
{
v57 = v5[2];
LODWORD(v75) = v57;
v74 = v5[1];
v68 = 2048;
if( v57 <= 0x800 )
v68 = v57;
}
v58 = 2i64 * v50;
*(&v78.Ptr + v58) = (unsigned __int64)&v74;
*((_QWORD *)&v78.Size + v58) = 4i64;
v59 = 2i64 * (v50 + 1);
*(&v78.Ptr + v59) = (unsigned __int64)&v75;
*((_QWORD *)&v78.Size + v59) = 4i64;
v60 = v68;
v61 = v50 + 2;
v50 += 3;
v61 *= 2i64;
*(&v78.Ptr + v61) = (unsigned __int64)&v68;
*((_QWORD *)&v78.Size + v61) = 2i64;
if( (_WORD)v60 )
{
v62 = 2i64 * v50++;
*(&v78.Ptr + v62) = (unsigned __int64)(v5 + 3);
*(&v78.Size + 2 * v62) = v60;
*(&v78.Reserved + 2 * v62) = 0;
}
}
if( v21 == 1 || (v63 = *(int *)(v21 + 8) < 0, BYTE4(ObjectName[1]) = 1, !v63) )
BYTE4(ObjectName[1]) = 2;
EtwWrite(EtwpRegTraceHandle, (EVENT_DESCRIPTOR *)&ObjectName[1], 0i64, v50, &v78);
if( P )
ExFreePoolWithTag(P, 0);
if( v5 )
ExFreePoolWithTag(v5, 0);
return 0;
}
v27 = ETW_REGISTRY_EVENT_CLOSE_KEY;
v21 = 1i64;
LABEL_41:
*(_OWORD *)&ObjectName[1] = v27;
goto LABEL_20;
}
if( (EtwpRegTraceOptions & 4) != 0 )
EtwpCapturePreviousRegistryData((_REG_SET_VALUE_KEY_INFORMATION *)Argument2);
return 0;
}Referenced by:
No references.