EtwpAddMicroarchitecturalPmcToRegistry

INT64 __stdcall EtwpAddMicroarchitecturalPmcToRegistry(UINT8 *a1, INT64 a2){
  __int64 v4; 
  unsigned int v5; 
  UINT64 v6; 
  WCHAR *PoolWithTag; 
  INT64 v8; 
  WCHAR *v9; 
  int MatchingPmcRegistryGroup; 
  WCHAR v12; 
  __int64 *v13; 
  _DWORD *v14; 
  __int64 v15; 
  unsigned int v16; 
  WCHAR v17; 
  WCHAR v18; 
  PCWSTR *v19; 
  _DWORD *v20; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsb; 
  unsigned int Data; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 v28[3]; 
  v28[0] = (__int64)L"Family";
  KeyHandle = 0i64;
  v28[1] = (__int64)L"Model";
  v28[2] = (__int64)L"Stepping";
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  Data = KiGetCpuVendor();
  v4 = -1i64;
  do
    ++v4;
  while( aRegistryMachin_24[v4] );
  v5 = 2 * v4 + 514;
  v6 = v5;
  PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v5, 0x50777445ui64);
  v9 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225495i64;
  MatchingPmcRegistryGroup = EtwpFindMatchingPmcRegistryGroup(v8, Data, a2, v5, PoolWithTag);
  if( MatchingPmcRegistryGroup >= 0 )
    goto LABEL_16;
  RtlStringCbPrintfW(v9, v6, (WCHAR *)L"%ws\\%ws:%d");
  v13 = v28;
  v14 = (_DWORD *)a2;
  v15 = 3i64;
  do
  {
    if( *v14 != -1 )
      RtlStringCbPrintfW(v9, v6, (WCHAR *)L"%ws-%ws:%d");
    ++v14;
    ++v13;
    --v15;
  }
  while( v15 );
  RtlInitUnicodeString(&DestinationString, v9, v12);
  v16 = 0;
  ObjectAttributes.Length = 48;
  LODWORD(CreateOptions) = 0;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  MatchingPmcRegistryGroup = ZwCreateKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  if( MatchingPmcRegistryGroup >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"Architecture", v17);
    LODWORD(CreateOptionsa) = 4;
    MatchingPmcRegistryGroup = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsa);
    v19 = (PCWSTR *)v28;
    v20 = (_DWORD *)a2;
    do
    {
      if( *v20 != -1 )
      {
        RtlInitUnicodeString(&DestinationString, *v19, v18);
        LODWORD(CreateOptionsb) = 4;
        MatchingPmcRegistryGroup = ZwSetValueKey(
                                     KeyHandle,
                                     &DestinationString,
                                     0i64,
                                     4ui64,
                                     (PVOID)(a2 + 4i64 * v16),
                                     CreateOptionsb);
        if( MatchingPmcRegistryGroup < 0 )
          break;
      }
      ++v16;
      ++v20;
      ++v19;
    }
    while( v16 < 3 );
    ZwClose(KeyHandle);
    if( MatchingPmcRegistryGroup >= 0 )
LABEL_16:
      EtwpAddMicroarchitecturalPmcToPmcGroup((INT64)v9, a1);
  }
  ExFreePoolWithTag(v9, 0x50777445u);
  return(unsigned int)MatchingPmcRegistryGroup;
}

Referenced by: