EtwpAddMicroarchitecturalPmcToRegistry

NTSTATUS __fastcall EtwpAddMicroarchitecturalPmcToRegistry(UINT8 *a1, INT64 a2){
  __int64 v4; 
  unsigned int v5; 
  UINT64 v6; 
  VOID **pszDest; 
  INT64 v8; 
  WCHAR *v9; 
  int MatchingPmcRegistryGroup; 
  __int64 *v12; 
  _DWORD *v13; 
  __int64 v14; 
  unsigned int v15; 
  PCWSTR *v16; 
  _DWORD *v17; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsb; 
  INT64 Data; 
  VOID *KeyHandle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 v25[3]; 

  v25[0] = (__int64)L"Family";
  KeyHandle = 0i64;
  v25[1] = (__int64)L"Model";
  v25[2] = (__int64)L"Stepping";
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  LODWORD(Data) = KiGetCpuVendor();
  v4 = -1i64;
  do
    ++v4;
  while( aRegistryMachin_24[v4] );
  v5 = 2 * v4 + 514;
  v6 = v5;
  pszDest = ExAllocatePoolWithTag(1ui64, v5, 1350005829i64);
  v9 = (WCHAR *)pszDest;
  if( !pszDest )
    return -1073741801;
  MatchingPmcRegistryGroup = EtwpFindMatchingPmcRegistryGroup(v8, (unsigned int)Data, a2, v5, (WCHAR *)pszDest);
  if( MatchingPmcRegistryGroup >= 0 )
    goto LABEL_16;
  RtlStringCbPrintfW(v9, v6, (WCHAR *)L"%ws\\%ws:%d");
  v12 = v25;
  v13 = (_DWORD *)a2;
  v14 = 3i64;
  do
  {
    if( *v13 != -1 )
      RtlStringCbPrintfW(v9, v6, (WCHAR *)L"%ws-%ws:%d");
    ++v13;
    ++v12;
    --v14;
  }
  while( v14 );
  RtlInitUnicodeString(&DestinationString, v9);
  v15 = 0;
  ObjectAttributes.Length = 48;
  LODWORD(CreateOptions) = 0;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  MatchingPmcRegistryGroup = ZwCreateKey(&KeyHandle, 0x2001Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  if( MatchingPmcRegistryGroup >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"Architecture");
    LODWORD(CreateOptionsa) = 4;
    MatchingPmcRegistryGroup = ZwSetValueKey(KeyHandle, &DestinationString, 0i64, 4ui64, &Data, CreateOptionsa);
    v16 = (PCWSTR *)v25;
    v17 = (_DWORD *)a2;
    do
    {
      if( *v17 != -1 )
      {
        RtlInitUnicodeString(&DestinationString, *v16);
        LODWORD(CreateOptionsb) = 4;
        MatchingPmcRegistryGroup = ZwSetValueKey(
                                     KeyHandle,
                                     &DestinationString,
                                     0i64,
                                     4ui64,
                                     (VOID *)(a2 + 4i64 * v15),
                                     CreateOptionsb);
        if( MatchingPmcRegistryGroup < 0 )
          break;
      }
      ++v15;
      ++v17;
      ++v16;
    }
    while( v15 < 3 );
    ZwClose((_HANDLE)KeyHandle);
    if( MatchingPmcRegistryGroup >= 0 )
LABEL_16:
      EtwpAddMicroarchitecturalPmcToPmcGroup((INT64)v9, a1);
  }
  ExFreePoolWithTag(v9, 0x50777445u);
  return MatchingPmcRegistryGroup;
}

Referenced by: