EtwpCapturePreviousRegistryData

VOID __fastcall EtwpCapturePreviousRegistryData(_REG_SET_VALUE_KEY_INFORMATION *SetValueKeyInfo){
  void *PoolWithTag; 
  PVOID Object; 
  ULONG Length; 
  NTSTATUS v5; 
  struct _UNICODE_STRING ValueName; 
  SIZE_T NumberOfBytes; 
  HANDLE KeyHandle; 
  KeyHandle = 0i64;
  LODWORD(NumberOfBytes) = 0;
  PoolWithTag = 0i64;
  Object = SetValueKeyInfo->Object;
  ValueName = *SetValueKeyInfo->ValueName;
  if( ObOpenObjectByPointer(Object, 0x200u, 0i64, 0x20019u, (POBJECT_TYPE)CmKeyObjectType, 0, &KeyHandle) >= 0 )
  {
    do
    {
      Length = NumberOfBytes;
      if( (_DWORD)NumberOfBytes )
      {
        if( PoolWithTag )
        {
          ExFreePoolWithTag(PoolWithTag, 0);
          Length = NumberOfBytes;
        }
        PoolWithTag = ExAllocatePoolWithTag(PagedPool, Length, 0x31777445ui64);
        if( !PoolWithTag )
          goto LABEL_13;
        Length = NumberOfBytes;
      }
      v5 = ZwQueryValueKey(
             KeyHandle,
             &ValueName,
             KeyValuePartialInformation,
             PoolWithTag,
             Length,
             (PULONG)&NumberOfBytes);
    }
    while( v5 == -2147483643 || v5 == -1073741789 );
    if( v5 < 0 )
    {
      if( PoolWithTag )
        ExFreePoolWithTag(PoolWithTag, 0);
    }
    else
    {
      SetValueKeyInfo->CallContext = PoolWithTag;
    }
  }
LABEL_13:
  if( KeyHandle )
    ZwClose(KeyHandle);
}

Referenced by: