EtwpLoadMicroarchitecturalPmcs

VOID __stdcall EtwpLoadMicroarchitecturalPmcs(){
  __int64 v0; 
  UINT64 v1; 
  WCHAR *PoolWithTag; 
  WCHAR v3; 
  unsigned int v4; 
  NTSTATUS v5; 
  int v6; 
  WCHAR v7; 
  __int16 *Length; 
  ULONG ResultLength[2]; 
  void *KeyHandle; 
  void *DestinationString[3]; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  char KeyInformation[12]; 
  unsigned int v14; 
  __int16 v15[264]; 
  KeyHandle = 0i64;
  memset(DestinationString, 0, sizeof(DestinationString));
  memset((INT64)KeyInformation, 0i64);
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  ResultLength[0] = 0;
  v0 = -1i64;
  do
    ++v0;
  while( aRegistryMachin_24[v0] );
  v1 = (unsigned int)(2 * v0 + 514);
  PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v1, 0x50777445ui64);
  if( PoolWithTag )
  {
    RtlInitUnicodeString(
      (PUNICODE_STRING)&DestinationString[1],
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI\\ProfileSource",
      v3);
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenKey(DestinationString, 0x20019u, &ObjectAttributes) >= 0 )
    {
      v4 = -1;
      do
      {
        ++v4;
        LODWORD(Length) = 534;
        v5 = ZwEnumerateKey(
               DestinationString[0],
               v4,
               KeyBasicInformation,
               KeyInformation,
               (UINT64)Length,
               (UINT64 *)ResultLength);
        v6 = v5;
        if( v5 < 0 || v14 >= 0x1FE )
        {
          if( v5 == -1073741789 || v5 == -2147483643 )
            v6 = 0;
        }
        else
        {
          Length = v15;
          v15[(unsigned __int64)v14 >> 1] = 0;
          if( (int)RtlStringCbPrintfW(PoolWithTag, v1, (WCHAR *)L"%ws\\%ws") >= 0 )
          {
            RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], PoolWithTag, v7);
            ObjectAttributes.Length = 48;
            ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
            ObjectAttributes.RootDirectory = 0i64;
            ObjectAttributes.Attributes = 576;
            *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
            if( ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes) >= 0 )
            {
              EtwpLoadMicroarchitecturalProfileGroup(KeyHandle);
              ZwClose(KeyHandle);
            }
          }
        }
      }
      while( v6 >= 0 );
      ZwClose(DestinationString[0]);
    }
    ExFreePoolWithTag(PoolWithTag, 0x50777445u);
  }
}

Referenced by: