EtwpAddMicroarchitecturalPmcToPmcGroup

NTSTATUS __stdcall EtwpAddMicroarchitecturalPmcToPmcGroup(INT64 a1, UINT8 *a2){
  UINT8 *v2; 
  __int64 v4; 
  __int64 v5; 
  UINT64 v7; 
  VOID **PoolWithTag; 
  int v9; 
  int CpuVendor; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsb; 
  UINT64 CreateOptionsc; 
  UINT64 CreateOptionsd; 
  UINT64 CreateOptionse; 
  UINT64 CreateOptionsf; 
  UINT64 CreateOptionsg; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  int Data; 
  VOID *KeyHandle; 

  v2 = a2 + 184;
  *(&ObjectAttributes.Length + 1) = 0;
  v4 = -1i64;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  v5 = -1i64;
  Data = 0;
  DestinationString = 0i64;
  do
    ++v5;
  while( *(_WORD *)&v2[2 * v5] );
  if( (unsigned int)v5 >= 0xFF )
    return -1073741820;
  do
    ++v4;
  while( *(_WORD *)(a1 + 2 * v4) );
  v7 = (unsigned int)(2 * v4 + 512);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v7, 1350005829i64);
  RtlStringCbPrintfW((WCHAR *)PoolWithTag, (unsigned int)v7, (WCHAR *)L"%ws\\%ws");
  RtlInitUnicodeString(&DestinationString, (PCWSTR)PoolWithTag);
  LODWORD(CreateOptions) = 0;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v9 = ZwCreateKey(&KeyHandle, 0x20006ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  if( v9 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"Interval");
    LODWORD(CreateOptionsa) = 4;
    v9 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, a2 + 8, CreateOptionsa);
    if( v9 >= 0 )
    {
      CpuVendor = KiGetCpuVendor();
      if( (unsigned int)(CpuVendor - 1) > 1 )
      {
LABEL_17:
        v9 = -1073741822;
        goto LABEL_18;
      }
      Data = *a2;
      RtlInitUnicodeString(&DestinationString, L"Event");
      LODWORD(CreateOptionsb) = 4;
      v9 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsb);
      if( v9 >= 0 )
      {
        if( (unsigned int)(CpuVendor - 1) <= 1 )
        {
          Data = a2[1];
          RtlInitUnicodeString(&DestinationString, L"Unit");
          LODWORD(CreateOptionsc) = 4;
          v9 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsc);
          if( v9 >= 0 && CpuVendor == 2 )
          {
            Data = a2[2];
            RtlInitUnicodeString(&DestinationString, L"CMask");
            LODWORD(CreateOptionsd) = 4;
            v9 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsd);
            if( v9 >= 0 )
            {
              Data = a2[3];
              RtlInitUnicodeString(&DestinationString, L"CMaskInvert");
              LODWORD(CreateOptionse) = 4;
              v9 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionse);
              if( v9 >= 0 )
              {
                Data = a2[4];
                RtlInitUnicodeString(&DestinationString, L"AnyThread");
                LODWORD(CreateOptionsf) = 4;
                v9 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsf);
                if( v9 >= 0 )
                {
                  Data = a2[5];
                  RtlInitUnicodeString(&DestinationString, L"EdgeDetect");
                  LODWORD(CreateOptionsg) = 4;
                  v9 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsg);
                }
              }
            }
          }
          goto LABEL_18;
        }
        goto LABEL_17;
      }
    }
  }
LABEL_18:
  ExFreePoolWithTag(PoolWithTag, 0x50777445u);
  return v9;
}

Referenced by: