EtwpFindMatchingPmcRegistryGroup

INT64 __fastcall EtwpFindMatchingPmcRegistryGroup(INT64 a1, INT64 a2, INT64 r8_0, UINT64 a4, WCHAR *pszDest){
  UINT64 v6; 
  int v7; 
  char v8; 
  WCHAR v9; 
  unsigned int v10; 
  NTSTATUS v11; 
  WCHAR v12; 
  unsigned __int64 v13; 
  INT64 result; 
  PUNICODE_STRING Class; 
  UINT64 CreateOptions; 
  ULONG ResultLength[2]; 
  void *KeyHandle; 
  PVOID DestinationString[3]; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyInformation[12]; 
  unsigned int v22; 
  __int16 v23[264]; 
  INT64 a3; 
  unsigned int v25; 
  v6 = (unsigned int)a4;
  v7 = a2;
  KeyHandle = 0i64;
  memset((INT64)KeyInformation, 0i64);
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  ResultLength[0] = 0;
  ResultLength[1] = 0;
  v8 = 0;
  memset(DestinationString, 0, sizeof(DestinationString));
  RtlInitUnicodeString(
    (PUNICODE_STRING)&DestinationString[1],
    L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI\\ProfileSource",
    v9);
  LODWORD(CreateOptions) = 0;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ZwCreateKey(DestinationString, 0x20019ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  v10 = -1;
  while( 1 )
  {
    ++v10;
    LODWORD(Class) = 534;
    v11 = ZwEnumerateKey(
            DestinationString[0],
            v10,
            KeyBasicInformation,
            KeyInformation,
            (UINT64)Class,
            (UINT64 *)&ResultLength[1]);
    if( v11 < 0 || v22 >= 0xFF )
    {
      if( v11 == -1073741789 || v11 == -2147483643 )
        v11 = 0;
      goto LABEL_16;
    }
    v23[(unsigned __int64)v22 >> 1] = 0;
    Class = (PUNICODE_STRING)v23;
    RtlStringCbPrintfW(pszDest, v6, (WCHAR *)L"%ws\\%ws");
    RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], pszDest, v12);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes) >= 0 )
    {
      EtwpGetPmcCpuHierarchyRegistry((PWCHAR)KeyHandle, ResultLength, (INT64)&a3);
      ZwClose(KeyHandle);
      if( ResultLength[0] == v7 )
      {
        v13 = a3 - *(_QWORD *)r8_0;
        if( a3 == *(_QWORD *)r8_0 )
          v13 = v25 - (unsigned __int64)*(unsigned int *)(r8_0 + 8);
        if( !v13 )
          break;
      }
    }
LABEL_16:
    if( v11 < 0 )
      goto LABEL_10;
  }
  v8 = 1;
LABEL_10:
  ZwClose(DestinationString[0]);
  result = 0i64;
  if( !v8 )
  {
    memset((INT64)pszDest, 0i64);
    return 3221225473i64;
  }
  return result;
}

Referenced by: