EtwpRemoveMicroarchitecturalPmcFromPmcGroup

NTSTATUS __stdcall EtwpRemoveMicroarchitecturalPmcFromPmcGroup(PCWSTR SourceString, WCHAR *Str1, size_t MaxCount){
  __int64 v3; 
  __int64 v6; 
  UINT64 v7; 
  VOID **PoolWithTag; 
  INT64 v10; 
  int Key; 
  unsigned int v12; 
  INT64 v13; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 *ResultLengtha; 
  INT64 v18; 
  VOID *KeyHandle; 
  VOID *Handle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 v23[2]; 
  __int64 v24; 
  int KeyInformation[136]; 

  v3 = MaxCount;
  v24 = 0i64;
  memset(v23, 0, sizeof(v23));
  memset(KeyInformation, 0i64, 0x218u);
  DestinationString = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  v6 = -1i64;
  *(&ObjectAttributes.Attributes + 1) = 0;
  KeyHandle = 0i64;
  Handle = 0i64;
  LODWORD(v18) = 0;
  do
    ++v6;
  while( SourceString[v6] );
  v7 = 2i64 * (unsigned int)(v6 + v3 + 2);
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v7, 1350005829i64);
  if( !PoolWithTag )
    return -1073741801;
  RtlInitUnicodeString(&DestinationString, SourceString);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  Key = ZwOpenKey(&KeyHandle, 0xF003Fui64, &ObjectAttributes, v10, Length, (INT64)ResultLength, v18, (INT64)KeyHandle);
  if( Key < 0 )
    goto LABEL_21;
  v12 = -1;
  while( 1 )
  {
    ++v12;
    LODWORD(Lengtha) = 534;
    Key = ZwEnumerateKey(KeyHandle, v12, KeyBasicInformation, KeyInformation, Lengtha, (UINT64 *)&v18);
    if( Key < 0 || KeyInformation[3] != 2 * v3 )
    {
      if( Key == -1073741789 || Key == -2147483643 )
        Key = 0;
      goto LABEL_15;
    }
    *((_WORD *)&KeyInformation[4] + v3) = 0;
    if( !wcsncmp(Str1, (const WCHAR *)&KeyInformation[4], v3) )
      break;
LABEL_15:
    if( Key < 0 )
      goto LABEL_16;
  }
  RtlStringCbPrintfW((WCHAR *)PoolWithTag, v7, (WCHAR *)L"%ws\\%ws");
  RtlInitUnicodeString(&DestinationString, (PCWSTR)PoolWithTag);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  Key = ZwOpenKey(
          &Handle,
          0xF003Fui64,
          &ObjectAttributes,
          v13,
          (INT64)&KeyInformation[4],
          (INT64)ResultLengtha,
          v18,
          (INT64)KeyHandle);
  if( Key < 0 )
    goto LABEL_20;
  ZwDeleteKey(Handle);
  ZwClose((_HANDLE)Handle);
LABEL_16:
  if( Key >= 0 )
  {
    Key = ZwQueryKey(KeyHandle, KeyCachedInformation, v23, 0x28ui64, (UINT64 *)&v18);
    if( Key >= 0 && !HIDWORD(v23[0]) )
      ZwDeleteKey(KeyHandle);
  }
LABEL_20:
  ZwClose((_HANDLE)KeyHandle);
LABEL_21:
  ExFreePoolWithTag(PoolWithTag, 0x50777445u);
  return Key;
}

Referenced by: