PspInitPhase2

NTSTATUS __fastcall PspInitPhase2(_LOADER_PARAMETER_BLOCK *LoaderBlock){
  PEPROCESS v1; 
  _LARGE_INTEGER v2; 
  unsigned __int64 UnbiasedInterruptTime; 
  _QWORD *v4; 
  unsigned __int8 v5; 
  unsigned __int8 v6; 
  NTSTATUS result; 
  UINT64 Seed; 

  TraceLoggingRegisterEx_EtwRegister_EtwSetInformation((char *)&stru_140C00F40 + 2928);
  v1 = PsInitialSystemProcess;
  v2.anonymous_0.LowPart = RtlGetSystemTimePrecise();
  v1->CreateTime = v2;
  PsInitialSystemProcess->CreateInterruptTime = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
  UnbiasedInterruptTime = KiQueryUnbiasedInterruptTime(1u);
  v4 = *(_QWORD **)&PsIdleProcess;
  PsInitialSystemProcess->CreateUnbiasedInterruptTime = UnbiasedInterruptTime;
  v4[141] = PsInitialSystemProcess->CreateTime.QuadPart;
  v4[288] = PsInitialSystemProcess->CreateInterruptTime;
  v4[289] = PsInitialSystemProcess->CreateUnbiasedInterruptTime;
  RtlGetSystemTimePrecise();
  PspWorkOnBehalfEncodingKey = (unsigned __int64)(unsigned int)RtlRandom(&Seed) << 32;
  PspWorkOnBehalfEncodingKey = (unsigned int)RtlRandom(&Seed) | (unsigned __int64)PspWorkOnBehalfEncodingKey;
  if( PspSehValidationPolicy )
  {
    if( PspSehValidationPolicy == 2 )
      v5 = KUSER_SHARED_DATA.MitigationPolicies & 0xF3 | 8;
    else
      v5 = KUSER_SHARED_DATA.MitigationPolicies & 0xF3 | 4;
  }
  else
  {
    v5 = KUSER_SHARED_DATA.MitigationPolicies & 0xF3;
  }
  KUSER_SHARED_DATA.MitigationPolicies = v5;
  switch( PspCurDirDevicesSkippedForDlls )
  {
    case 1:
      v6 = v5 & 0xCF | 0x10;
      break;
    case 2:
      v6 = v5 & 0xCF | 0x20;
      break;
    case -1:
      v6 = v5 | 0x30;
      break;
    default:
      v6 = v5 & 0xCF;
      break;
  }
  KUSER_SHARED_DATA.MitigationPolicies = v6;
  PspInitializeSystemDlls();
  result = PspInitializeProtectedProcessParameters((INT64)&PspHostSiloGlobals);
  LOBYTE(result) = result >= 0;
  return result;
}

Referenced by: