EtwpLoadMicroarchitecturalProfileGroup

NTSTATUS __stdcall EtwpLoadMicroarchitecturalProfileGroup(_HANDLE KeyHandle){
  __int64 v1; 
  __int64 v2; 
  _KEXCEPTION_FRAME *v3; 
  int CpuVendor; 
  __int64 v5; 
  char *v6; 
  __int64 *v7; 
  char *v8; 
  INT64 *v9; 
  char *v10; 
  __int64 v11; 
  __int64 v12; 
  NTSTATUS result; 
  UINT64 v14; 
  VOID **PoolWithTag; 
  unsigned int v16; 
  __int64 v17; 
  INT64 v18; 
  INT64 *Length; 
  UINT64 *ResultLength; 
  INT64 v21; 
  WCHAR *Handle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _KAFFINITY_EX Source; 
  INT64 KeyInformation[68]; 
  INT64 v27; 
  int v28; 
  __int64 v29[4]; 
  char v30; 
  char v31[280]; 

  v2 = v1;
  v3 = *(_KEXCEPTION_FRAME **)&KeyHandle;
  v21 = 0i64;
  memset(KeyInformation, 0i64, 0x218u);
  v29[0] = (__int64)L"Family";
  v29[1] = (__int64)L"Model";
  v29[2] = (__int64)L"Stepping";
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  memset(&Source, 0i64, sizeof(Source));
  Handle = 0i64;
  CpuVendor = KiGetCpuVendor();
  EtwpGetPmcCpuHierarchyRegistry(v3, &v21, (__int64)&v27);
  memset(&v31[56], 0i64, 0xE0u);
  v5 = -1i64;
  v6 = v31;
  v27 = -1i64;
  v7 = v29;
  v28 = -1;
  v8 = &v31[80];
  v9 = &v27;
  v10 = &v30;
  v11 = 3i64;
  do
  {
    *(_QWORD *)v8 = v10;
    *((_QWORD *)v8 - 3) = EtwpQueryRegistryCallback;
    v10 += 16;
    v12 = *v7++;
    *(_QWORD *)v6 = v9;
    v9 = (INT64 *)((char *)v9 + 4);
    *((_QWORD *)v8 - 1) = v12;
    *((_DWORD *)v8 + 2) = 4;
    v8 += 56;
    *((_DWORD *)v6 - 2) = 4;
    v6 += 16;
    --v11;
  }
  while( v11 );
  LOBYTE(result) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, v3);
  if( result >= 0 && (_DWORD)v21 == CpuVendor )
  {
    EtwpGetMicroarchitecturalPmcAffinity((INT64)&v27, &Source.Count);
    result = KeIsEmptyAffinityEx(&Source.Count);
    if( !result )
    {
      do
        ++v5;
      while( *(_WORD *)(v2 + 2 * v5) );
      v14 = (unsigned int)(2 * v5 + 512);
      PoolWithTag = ExAllocatePoolWithTag(1ui64, v14, 1350005829i64);
      v16 = -1;
      while( 1 )
      {
        ++v16;
        LODWORD(Length) = 534;
        if( ZwEnumerateKey(v3, v16, KeyBasicInformation, KeyInformation, (UINT64)Length, (UINT64 *)((char *)&v21 + 4)) < 0 )
          break;
        v17 = HIDWORD(KeyInformation[1]) >> 1;
        if( (unsigned int)v17 <= 0xFE )
        {
          *((_WORD *)&KeyInformation[2] + v17) = 0;
          Length = &KeyInformation[2];
          if( RtlStringCbPrintfW((WCHAR *)PoolWithTag, v14, (WCHAR *)L"%ws\\%ws") >= 0 )
          {
            RtlInitUnicodeString(&DestinationString, (PCWSTR)PoolWithTag);
            ObjectAttributes.Length = 48;
            ObjectAttributes.ObjectName = &DestinationString;
            ObjectAttributes.RootDirectory = 0i64;
            ObjectAttributes.Attributes = 576;
            *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
            if( ZwOpenKey(
                   (VOID **)&Handle,
                   0x20019ui64,
                   &ObjectAttributes,
                   v18,
                   (INT64)&KeyInformation[2],
                   (INT64)ResultLength,
                   v21,
                   (INT64)Handle) >= 0 )
            {
              EtwpLoadMicroarchitecturalProfileSource(Handle, &Source, (WCHAR *)&KeyInformation[2]);
              ZwClose((_HANDLE)&Handle);
            }
          }
        }
      }
      return(unsigned int)ExFreePoolWithTag(PoolWithTag, 0x50777445u);
    }
  }
  return result;
}

Referenced by: