EtwpFindMatchingPmcRegistryGroup

NTSTATUS __stdcall EtwpFindMatchingPmcRegistryGroup(INT64 a1, INT64 a2, INT64 a3, UINT64 a4, WCHAR *pszDest){
  UINT64 v6; 
  int v7; 
  char v8; 
  unsigned int v9; 
  NTSTATUS v10; 
  INT64 v11; 
  unsigned __int64 v12; 
  NTSTATUS result; 
  _UNICODE_STRING *Class; 
  UINT64 CreateOptions; 
  INT64 CreateOptionsa; 
  UINT64 *Disposition; 
  INT64 v18; 
  UINT64 ResultLength; 
  VOID *KeyHandle; 
  VOID *DestinationString[3]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  INT64 KeyInformation[68]; 
  __int64 v24; 
  unsigned int v25; 

  v6 = (unsigned int)a4;
  v7 = a2;
  KeyHandle = 0i64;
  memset(KeyInformation, 0i64, 0x218u);
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  ResultLength = 0i64;
  v8 = 0;
  memset(DestinationString, 0, sizeof(DestinationString));
  RtlInitUnicodeString(
    (PUNICODE_STRING)&DestinationString[1],
    L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\WMI\\ProfileSource");
  LODWORD(CreateOptions) = 0;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ZwCreateKey(DestinationString, 0x20019ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  v9 = -1;
  while( 1 )
  {
    ++v9;
    LODWORD(Class) = 534;
    v10 = ZwEnumerateKey(
            DestinationString[0],
            v9,
            KeyBasicInformation,
            KeyInformation,
            (UINT64)Class,
            (UINT64 *)((char *)&ResultLength + 4));
    if( v10 < 0 || HIDWORD(KeyInformation[1]) >= 0xFF )
    {
      if( v10 == -1073741789 || v10 == -2147483643 )
        v10 = 0;
      goto LABEL_16;
    }
    *((_WORD *)&KeyInformation[2] + ((unsigned __int64)HIDWORD(KeyInformation[1]) >> 1)) = 0;
    RtlStringCbPrintfW(pszDest, v6, (WCHAR *)L"%ws\\%ws");
    RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], pszDest);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenKey(
           &KeyHandle,
           0x20019ui64,
           &ObjectAttributes,
           v11,
           (INT64)&KeyInformation[2],
           CreateOptionsa,
           (INT64)Disposition,
           v18) >= 0 )
    {
      EtwpGetPmcCpuHierarchyRegistry((_KEXCEPTION_FRAME *)KeyHandle, &ResultLength, (__int64)&v24);
      ZwClose((_HANDLE)KeyHandle);
      if( (_DWORD)ResultLength == v7 )
      {
        v12 = v24 - *(_QWORD *)a3;
        if( v24 == *(_QWORD *)a3 )
          v12 = v25 - (unsigned __int64)*(unsigned int *)(a3 + 8);
        if( !v12 )
          break;
      }
    }
LABEL_16:
    if( v10 < 0 )
      goto LABEL_10;
  }
  v8 = 1;
LABEL_10:
  ZwClose((_HANDLE)DestinationString[0]);
  result = 0;
  if( !v8 )
  {
    memset(pszDest, 0i64, v6);
    return -1073741823;
  }
  return result;
}

Referenced by: