CmFcManagerStartRuntimePhase
__int64 CmFcManagerStartRuntimePhase(){
__int64 *v0;
__int64 v1;
__int64 v2;
__int64 v3;
int SectionFromBuffer;
_ETHREAD *CurrentThread;
__int64 v6;
__int64 *v7;
__int64 v8;
_LARGE_INTEGER *v9;
VOID *v10;
VOID *QuadPart;
unsigned int v12;
unsigned int v13;
int v14;
__int64 v15;
__int64 v16;
__int64 v17;
unsigned int i;
__int64 v19;
_OWORD *v20;
VOID **PoolWithTag;
VOID **v22;
__int64 v23;
__int128 v24;
BOOL IsStateSeparationEnabled;
const wchar_t *v26;
__int64 *v27;
__int64 v28;
__int64 *v29;
UINT64 MatchingChangeStamp;
UINT64 CheckStamp;
INT64 Buffer;
INT64 v34[3];
__int64 v35[10];
__int64 v36[3];
char v37[24];
__int64 v38[4];
v0 = v36;
Buffer = 0i64;
*(_OWORD *)&v34[1] = 0i64;
v1 = 3i64;
do
{
CmFcpInitializeSectionState((__int64)v0);
v0 = (__int64 *)(v2 + 24);
}
while( v3 != 1 );
v34[0] = 0i64;
memset(v35, 0i64, 0x48u);
*(&CmpDummyThreadEvent + 1426) = 1;
SectionFromBuffer = SeConvertStringSecurityDescriptorToSecurityDescriptor((VOID **)L"O:SYG:SYD:(A;;GR;;;SY)(A;;GR;;;BA)("
"A;;GR;;;IU)(A;;GR;;;AU)(A;;GR;;;AC"
")(A;;GR;;;S-1-5-32-1045063015-4238"
"99465-3012769174-65638258-18658744"
"12-2349348127-763856749-1075684855"
")(A;;GR;;;S-1-15-3-1024-1045063015"
"-423899465-3012769174-65638258-186"
"5874412-2349348127-763856749-10756"
"84855)(A;;GR;;;S-1-5-80-2970612574"
"-78537857-698502321-558674196-1451"
"644582)(A;;GR;;;S-1-15-3-1024-1502"
"825166-1963708345-2616377461-25628"
"97074-4192028372-3968301570-199762"
"8692-1435953622)");
if( SectionFromBuffer >= 0 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
CmpVolumeManagerLockContextListExclusive((UINT64)&CmpDummyThreadEvent + 1104);
RtlpFcBufferManagerReferenceBuffers((__int64)&CmpDummyThreadEvent + 1200, (__int64)&Buffer, v34);
v6 = Buffer;
v7 = v36;
v8 = 3i64;
do
{
*v7 = v6;
v7 += 3;
--v8;
}
while( v8 );
v9 = (_LARGE_INTEGER *)v34[0];
v10 = *(VOID **)(v34[0] + 8);
if( v10 )
{
SectionFromBuffer = CmFcpManagerCreateSectionFromBuffer(
v10,
*(_LARGE_INTEGER *)(v34[0] + 16),
v6,
*(&CmpDummyThreadEvent + 136),
(__int64)v36);
if( SectionFromBuffer < 0 )
goto LABEL_30;
CmFcpCopySectionState((__int64)v37, (__int64)v36);
v6 = Buffer;
}
QuadPart = (VOID *)v9[7].QuadPart;
if( !QuadPart
|| (SectionFromBuffer = CmFcpManagerCreateSectionFromBuffer(
QuadPart,
v9[8],
v6,
*(&CmpDummyThreadEvent + 136),
(__int64)v38),
SectionFromBuffer >= 0) )
{
RtlpFcBufferManagerDereferenceBuffers((INT64 *)&CmpDummyThreadEvent + 150, (INT64)v9);
v9 = 0i64;
v12 = 0;
while( 1 )
{
v13 = RtlpFcSectionTypeToBufferType(v12);
CmFcpMapSection(&v36[3 * v12], &v35[3 * v13]);
SectionFromBuffer = v14;
if( v14 < 0 )
goto LABEL_33;
if( ++v12 >= 3 )
{
CmpVolumeManagerLockContextListExclusive((UINT64)&CmpDummyThreadEvent + 1096);
v15 = 0i64;
do
{
CmFcpSwapSectionState(
(__int64 *)((char *)&CmpDummyThreadEvent + v15 + 1128),
(__int64 *)((char *)v36 + v15));
v15 = v16 + 24;
}
while( v17 != 1 );
RtlpFcBufferManagerUpdateBuffers((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 150, Buffer, (__int64)v35);
memset(v35, 0i64, 0x48u);
RtlpFcWriteHighLowHigh(0xFFFFF78000000710ui64, Buffer);
CmSiRWLockReleaseExclusive((char *)&CmpDummyThreadEvent + 1096);
LODWORD(CheckStamp) = 0;
LODWORD(MatchingChangeStamp) = 0;
SectionFromBuffer = ZwUpdateWnfStateData(
&WNF_CMFC_FEATURE_CONFIGURATION_CHANGED,
&Buffer,
8ui64,
&CmFcpWnfTypeId,
0i64,
MatchingChangeStamp,
CheckStamp);
if( SectionFromBuffer >= 0 )
{
for( i = 0; i < 2; ++i )
{
v19 = ((unsigned __int8)RtlGetSwapReferenceIndex((_QWORD *)&CmpDummyThreadEvent + 174) - 1) & 1;
v20 = (_OWORD *)*((_QWORD *)&CmpDummyThreadEvent + v19 + 179);
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x310ui64, 1665559875i64);
v22 = PoolWithTag;
if( !PoolWithTag )
goto LABEL_32;
if( v20 )
{
v23 = 6i64;
do
{
*(_OWORD *)PoolWithTag = *v20;
*((_OWORD *)PoolWithTag + 1) = v20[1];
*((_OWORD *)PoolWithTag + 2) = v20[2];
*((_OWORD *)PoolWithTag + 3) = v20[3];
*((_OWORD *)PoolWithTag + 4) = v20[4];
*((_OWORD *)PoolWithTag + 5) = v20[5];
*((_OWORD *)PoolWithTag + 6) = v20[6];
PoolWithTag += 16;
v24 = v20[7];
v20 += 8;
*((_OWORD *)PoolWithTag - 1) = v24;
--v23;
}
while( v23 );
*(_OWORD *)PoolWithTag = *v20;
}
else
{
RtlpFcInitializeDelayedUsageReportBuffer((INT64)PoolWithTag);
}
*((_QWORD *)&CmpDummyThreadEvent + v19 + 179) = v22;
RtlUpdateSwapReference((_EX_PUSH_LOCK *)&CmpDummyThreadEvent + 174, v19);
}
*(&CmpDummyThreadEvent + 197) = ExAllocateTimer(
(INT64)CmFcpManagerRetryUsageNotificationsTimerRoutine,
(INT64)&CmpDummyThreadEvent + 1088,
8ui64);
if( !*(&CmpDummyThreadEvent + 197) )
{
LABEL_32:
SectionFromBuffer = -1073741670;
goto LABEL_33;
}
IsStateSeparationEnabled = RtlIsStateSeparationEnabled();
v26 = L"\\REGISTRY\\MACHINE\\OSDATA";
if( !IsStateSeparationEnabled )
v26 = L"\\REGISTRY\\MACHINE\\SOFTWARE";
RtlInitUnicodeString((PUNICODE_STRING)&v34[1], v26);
SectionFromBuffer = CmRegisterMachineHiveLoadedNotification(
(wchar_t **)CmFcpManagerSoftwareHiveReady,
(wchar_t **)&CmpDummyThreadEvent + 136,
(_UNICODE_STRING *)&v34[1],
(wchar_t ****)&CmpDummyThreadEvent + 173);
if( SectionFromBuffer >= 0 )
{
SectionFromBuffer = 0;
break;
}
}
goto LABEL_33;
}
}
}
LABEL_30:
if( v9 )
RtlpFcBufferManagerDereferenceBuffers((INT64 *)&CmpDummyThreadEvent + 150, (INT64)v9);
LABEL_33:
CmSiRWLockReleaseExclusive((char *)&CmpDummyThreadEvent + 1104);
KeLeaveCriticalRegion();
}
v27 = v35;
v28 = 3i64;
do
{
CmFcpUnmapSection((__int64)v27);
v27 += 3;
--v28;
}
while( v28 );
v29 = v36;
do
{
CmFcpCleanupSectionState((__int64)v29);
v29 += 3;
--v1;
}
while( v1 );
return(unsigned int)SectionFromBuffer;
}Referenced by:
CmFcInitSystem2