EtwpLoadMicroarchitecturalProfileGroup

INT64 __stdcall EtwpLoadMicroarchitecturalProfileGroup(HANDLE KeyHandle){
  __int64 v1; 
  __int64 v2; 
  int CpuVendor; 
  __int64 v5; 
  char *v6; 
  __int64 *v7; 
  char *v8; 
  INT64 *p_a3; 
  char *v10; 
  __int64 v11; 
  __int64 v12; 
  INT64 IsEmptyAffinity; 
  UINT64 v14; 
  WCHAR *PoolWithTag; 
  unsigned int v16; 
  __int64 v17; 
  WCHAR v18; 
  wchar_t *Length; 
  int a2; 
  ULONG ResultLength; 
  void *KeyHandlea; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  INT64 result[22]; 
  char KeyInformation[12]; 
  unsigned int v27; 
  wchar_t v28[264]; 
  INT64 a3; 
  int v30; 
  __int64 v31[4]; 
  char v32; 
  char v33; 
  INT64 v34[3]; 
  char v35; 
  v2 = v1;
  a2 = 0;
  memset((INT64)KeyInformation, 0i64);
  v31[0] = (__int64)L"Family";
  v31[1] = (__int64)L"Model";
  v31[2] = (__int64)L"Stepping";
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  memset((INT64)result, 0i64);
  KeyHandlea = 0i64;
  ResultLength = 0;
  CpuVendor = KiGetCpuVendor();
  EtwpGetPmcCpuHierarchyRegistry((PWCHAR)KeyHandle, &a2, (INT64)&a3);
  memset((INT64)v34, 0i64);
  v5 = -1i64;
  v6 = &v33;
  a3 = -1i64;
  v7 = v31;
  v30 = -1;
  v8 = &v35;
  p_a3 = &a3;
  v10 = &v32;
  v11 = 3i64;
  do
  {
    *(_QWORD *)v8 = v10;
    *((_QWORD *)v8 - 3) = EtwpQueryRegistryCallback;
    v10 += 16;
    v12 = *v7++;
    *(_QWORD *)v6 = p_a3;
    p_a3 = (INT64 *)((char *)p_a3 + 4);
    *((_QWORD *)v8 - 1) = v12;
    *((_DWORD *)v8 + 2) = 4;
    v8 += 56;
    *((_DWORD *)v6 - 2) = 4;
    v6 += 16;
    --v11;
  }
  while( v11 );
  LOBYTE(IsEmptyAffinity) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, (_KEXCEPTION_FRAME *)KeyHandle);
  if( (int)IsEmptyAffinity >= 0 && a2 == CpuVendor )
  {
    EtwpGetMicroarchitecturalPmcAffinity((INT64)&a3, (UINT16 *)result);
    IsEmptyAffinity = KeIsEmptyAffinityEx(result);
    if( !(_DWORD)IsEmptyAffinity )
    {
      do
        ++v5;
      while( *(_WORD *)(v2 + 2 * v5) );
      v14 = (unsigned int)(2 * v5 + 512);
      PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v14, 0x50777445ui64);
      v16 = -1;
      while( 1 )
      {
        ++v16;
        LODWORD(Length) = 534;
        if( ZwEnumerateKey(
               KeyHandle,
               v16,
               KeyBasicInformation,
               KeyInformation,
               (UINT64)Length,
               (UINT64 *)&ResultLength) < 0 )
          break;
        v17 = v27 >> 1;
        if( (unsigned int)v17 <= 0xFE )
        {
          v28[v17] = 0;
          Length = v28;
          if( (int)RtlStringCbPrintfW(PoolWithTag, v14, (WCHAR *)L"%ws\\%ws") >= 0 )
          {
            RtlInitUnicodeString(&DestinationString, PoolWithTag, v18);
            ObjectAttributes.Length = 48;
            ObjectAttributes.ObjectName = &DestinationString;
            ObjectAttributes.RootDirectory = 0i64;
            ObjectAttributes.Attributes = 576;
            *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
            if( ZwOpenKey(&KeyHandlea, 0x20019u, &ObjectAttributes) >= 0 )
            {
              EtwpLoadMicroarchitecturalProfileSource((const WCHAR *)KeyHandlea, (unsigned __int16 *)result, v28);
              ZwClose(&KeyHandlea);
            }
          }
        }
      }
      ExFreePoolWithTag(PoolWithTag, 0x50777445u);
    }
  }
  return IsEmptyAffinity;
}

Referenced by: