EtwpAddMicroarchitecturalPmcToPmcGroup

INT64 __fastcall EtwpAddMicroarchitecturalPmcToPmcGroup(INT64 a1, UINT8 *a2){
  UINT8 *v2; 
  __int64 v4; 
  __int64 v5; 
  UINT64 v7; 
  WCHAR *PoolWithTag; 
  WCHAR v9; 
  NTSTATUS v10; 
  WCHAR v11; 
  int CpuVendor; 
  WCHAR v13; 
  WCHAR v14; 
  WCHAR v15; 
  WCHAR v16; 
  WCHAR v17; 
  WCHAR v18; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsb; 
  UINT64 CreateOptionsc; 
  UINT64 CreateOptionsd; 
  UINT64 CreateOptionse; 
  UINT64 CreateOptionsf; 
  UINT64 CreateOptionsg; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int Data; 
  void *KeyHandle; 
  v2 = a2 + 184;
  *(&ObjectAttributes.Length + 1) = 0;
  v4 = -1i64;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  v5 = -1i64;
  Data = 0;
  DestinationString = 0i64;
  do
    ++v5;
  while( *(_WORD *)&v2[2 * v5] );
  if( (unsigned int)v5 >= 0xFF )
    return 3221225476i64;
  do
    ++v4;
  while( *(_WORD *)(a1 + 2 * v4) );
  v7 = (unsigned int)(2 * v4 + 512);
  PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v7, 0x50777445ui64);
  RtlStringCbPrintfW(PoolWithTag, (unsigned int)v7, (WCHAR *)L"%ws\\%ws");
  RtlInitUnicodeString(&DestinationString, PoolWithTag, v9);
  LODWORD(CreateOptions) = 0;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v10 = ZwCreateKey(&KeyHandle, 0x20006ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  if( v10 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"Interval", v11);
    LODWORD(CreateOptionsa) = 4;
    v10 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, a2 + 8, CreateOptionsa);
    if( v10 >= 0 )
    {
      CpuVendor = KiGetCpuVendor();
      if( (unsigned int)(CpuVendor - 1) > 1 )
      {
LABEL_17:
        v10 = -1073741822;
        goto LABEL_18;
      }
      Data = *a2;
      RtlInitUnicodeString(&DestinationString, L"Event", v13);
      LODWORD(CreateOptionsb) = 4;
      v10 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsb);
      if( v10 >= 0 )
      {
        if( (unsigned int)(CpuVendor - 1) <= 1 )
        {
          Data = a2[1];
          RtlInitUnicodeString(&DestinationString, L"Unit", v14);
          LODWORD(CreateOptionsc) = 4;
          v10 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsc);
          if( v10 >= 0 && CpuVendor == 2 )
          {
            Data = a2[2];
            RtlInitUnicodeString(&DestinationString, L"CMask", v15);
            LODWORD(CreateOptionsd) = 4;
            v10 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsd);
            if( v10 >= 0 )
            {
              Data = a2[3];
              RtlInitUnicodeString(&DestinationString, L"CMaskInvert", v16);
              LODWORD(CreateOptionse) = 4;
              v10 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionse);
              if( v10 >= 0 )
              {
                Data = a2[4];
                RtlInitUnicodeString(&DestinationString, L"AnyThread", v17);
                LODWORD(CreateOptionsf) = 4;
                v10 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsf);
                if( v10 >= 0 )
                {
                  Data = a2[5];
                  RtlInitUnicodeString(&DestinationString, L"EdgeDetect", v18);
                  LODWORD(CreateOptionsg) = 4;
                  v10 = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsg);
                }
              }
            }
          }
          goto LABEL_18;
        }
        goto LABEL_17;
      }
    }
  }
LABEL_18:
  ExFreePoolWithTag(PoolWithTag, 0x50777445u);
  return(unsigned int)v10;
}

Referenced by: