EtwpRemoveMicroarchitecturalPmcFromRegistry
INT64 __stdcall EtwpRemoveMicroarchitecturalPmcFromRegistry(WCHAR *Str1, size_t MaxCount){
INT64 v2;
INT64 v3;
unsigned int v4;
unsigned int CpuVendor;
__int64 v7;
unsigned int v8;
unsigned int v9;
WCHAR *pszDest;
INT64 v11;
WCHAR *v12;
int MatchingPmcRegistryGroup;
v3 = v2;
v4 = MaxCount;
CpuVendor = KiGetCpuVendor();
v7 = -1i64;
v8 = CpuVendor;
do
++v7;
while( aRegistryMachin_24[v7] );
v9 = 2 * v7 + 514;
pszDest = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v9, 0x50777445ui64);
v12 = pszDest;
if( !pszDest )
return 3221225495i64;
MatchingPmcRegistryGroup = EtwpFindMatchingPmcRegistryGroup(v11, v8, v3, v9, pszDest);
if( MatchingPmcRegistryGroup >= 0 )
MatchingPmcRegistryGroup = EtwpRemoveMicroarchitecturalPmcFromPmcGroup(v12, Str1, v4);
ExFreePoolWithTag(v12, 0x50777445u);
return(unsigned int)MatchingPmcRegistryGroup;
}Referenced by:
EtwSetPerformanceTraceInformation