ExpWorkerInitialization
NTSTATUS __stdcall ExpWorkerInitialization(){
int v0;
unsigned int v1;
unsigned __int16 i;
NTSTATUS result;
_QWORD *v4;
char *v5;
__int64 v6;
__int64 v7;
int v8;
unsigned int v9;
__int64 v10;
unsigned __int64 v11;
char *v12;
unsigned __int64 v13;
signed __int64 v14;
signed __int64 v15;
_EX_PUSH_LOCK v16;
unsigned __int64 v17;
__int64 v18;
unsigned __int64 v19;
_ETHREAD *CurrentThread;
_ETHREAD *v21;
unsigned __int64 v22;
__int64 AbOrphanedEntrySummary;
char v24;
__int64 v25;
NTSTATUS SessionId;
bool v27;
_ETHREAD *v28;
int v29;
unsigned int v30;
unsigned __int8 v31;
int v32;
__int64 v33;
_KLOCK_ENTRY *v34;
unsigned int v35;
__int64 v36;
__int64 v37;
NTSTATUS v38;
char v39;
UINT64 a3;
*(&WheapDeferredInternalLogsEventLock + 2554) = 6;
*(&WheapDeferredInternalLogsEventLock + 317) = 0i64;
*(&WheapDeferredInternalLogsEventLock + 321) = (char *)&WheapDeferredInternalLogsEventLock + 2560;
*(&WheapDeferredInternalLogsEventLock + 320) = (char *)&WheapDeferredInternalLogsEventLock + 2560;
v0 = ExpMaximumKernelWorkerThreads;
*(&WheapDeferredInternalLogsEventLock + 632) = 1;
*(&WheapDeferredInternalLogsEventLock + 636) = 0;
*(&WheapDeferredInternalLogsEventLock + 1276) = 1;
*(&WheapDeferredInternalLogsEventLock + 639) = 0;
*(&WheapDeferredInternalLogsEventLock + 2584) = 1;
if( (int)ExpMaximumKernelWorkerThreads > 0x4000 )
{
v0 = 0x4000;
LODWORD(ExpMaximumKernelWorkerThreads) = 0x4000;
}
if( v0 < 32 )
LODWORD(ExpMaximumKernelWorkerThreads) = 32;
v1 = ExpWorkerThreadTimeoutInSeconds;
if( (unsigned int)ExpWorkerThreadTimeoutInSeconds > 0xE10 )
{
v1 = 3600;
ExpWorkerThreadTimeoutInSeconds = 3600;
}
if( v1 < 0x3C )
ExpWorkerThreadTimeoutInSeconds = 60;
for( i = 0; i < (unsigned __int16)KeNumberNodes; ++i )
ExpNodeInitialize();
result = ExpPartitionInitialize(PspSystemPartition);
if( result >= 0 )
{
result = ExpPartitionStart(*(_QWORD *)(PspSystemPartition + 16));
v38 = result;
if( result >= 0 )
{
ExpLegacyWorkerInitialization();
_mm_lfence();
if( qword_140C4C3A0 )
{
LABEL_22:
*(&WheapDeferredInternalLogsEventLock + 648) = 275;
*(&WheapDeferredInternalLogsEventLock + 327) = ExpDebuggerDpcRoutine;
*(&WheapDeferredInternalLogsEventLock + 334) = ExpDebuggerWorker;
*(&WheapDeferredInternalLogsEventLock + 328) = 0i64;
*(&WheapDeferredInternalLogsEventLock + 331) = 0i64;
*(&WheapDeferredInternalLogsEventLock + 326) = 0i64;
*(&WheapDeferredInternalLogsEventLock + 335) = 0i64;
*(&WheapDeferredInternalLogsEventLock + 332) = 0i64;
ExpDebuggerWork = 1;
ExQueueDebuggerWorker();
return v38;
}
v17 = __rdtsc();
v18 = (41929663 * (unsigned int)((((unsigned __int64)HIDWORD(v17) << 32) | (unsigned int)v17) >> 4)) ^ 0xBD6i64;
if( !v18 )
v18 = 1i64;
qword_140C4C3A0 = v18;
v19 = __rdtsc();
qword_140C4C3A8 = (41929663 * (unsigned int)((((unsigned __int64)HIDWORD(v19) << 32) | (unsigned int)v19) >> 4)) ^ 0x5EBi64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.SpecialApcDisable;
v21 = (_ETHREAD *)KeGetCurrentThread();
v22 = *(&stru_140C23628 + 837) + 184i64;
LODWORD(a3) = 0;
--v21->Tcb.SpecialApcDisable;
if( ++v21->Tcb.AbAllocationRegionCount != 1 )
KeBugCheckEx(0x192u, v21, (PVOID)v22, (PVOID)KeGetCurrentIrql(), 0i64);
LOBYTE(AbOrphanedEntrySummary) = v21->Tcb.AbEntrySummary;
if( !(_BYTE)AbOrphanedEntrySummary )
{
if( !v21->Tcb.AbOrphanedEntrySummary )
{
v25 = 0i64;
goto LABEL_51;
}
AbOrphanedEntrySummary = v21->Tcb.AbOrphanedEntrySummary;
v21->Tcb.AbOrphanedEntrySummary = 0;
LOBYTE(AbOrphanedEntrySummary) = v21->Tcb.AbEntrySummary | AbOrphanedEntrySummary;
}
v24 = AbOrphanedEntrySummary;
_BitScanForward((unsigned int *)&AbOrphanedEntrySummary, (unsigned __int8)AbOrphanedEntrySummary);
v21->Tcb.AbEntrySummary = v24 & ~(1 << AbOrphanedEntrySummary);
v25 = (__int64)&v21->Tcb.LockEntries[AbOrphanedEntrySummary];
if( v25 )
{
if( v22 >= 0xFFFF800000000000ui64 && *((_BYTE *)&stru_140C4DB30 + ((v22 >> 39) & 0x1FF) + 6872) == 1 )
SessionId = MmGetSessionIdEx(v21->Tcb.ApcState.Process);
else
SessionId = -1;
*(_DWORD *)(v25 + 40) = SessionId;
*(_QWORD *)(v25 + 32) = v22 & 0x7FFFFFFFFFFFFFFCi64;
goto LABEL_54;
}
LABEL_51:
_interlockedbittestandset((volatile signed __int32 *)&v21->Tcb.116 + 1, 0x10u);
LABEL_54:
--v21->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v21->Tcb, (VOID *)v22, &a3);
v27 = v21->Tcb.SpecialApcDisable++ == -1;
if( v27 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v21->Tcb.ApcState.ApcListHead[0].Flink != &v21->Tcb.152 )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)v22, 0i64) )
ExfAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v22, (VOID *)v25, (VOID *)v22);
if( v25 )
*(_BYTE *)(v25 + 26) |= 1u;
v9 = 0;
v8 = 64;
v10 = *(unsigned int *)(*(&stru_140C23628 + 837) + 44i64);
qword_140C4C3B8 = v10;
v11 = (unsigned int)v10;
if( (_DWORD)v10 )
{
v12 = (char *)&stru_140C23628 + 6712;
while( *(_QWORD *)v12 )
{
if( (*(_BYTE *)(*(_QWORD *)v12 + 66i64) & 0x40) != 0 )
_bittestandset64(&qword_140C4C3C0, v9);
++v9;
v12 += 8;
if( v9 >= (unsigned int)v10 )
goto LABEL_34;
}
v11 = v9;
LODWORD(v10) = v9;
qword_140C4C3B8 = v9;
}
LABEL_34:
v13 = *(&stru_140C23628 + 837) + 184i64;
_m_prefetchw((const void *)(*(&stru_140C23628 + 837) + 184i64));
v14 = *(_QWORD *)v13;
v15 = *(_QWORD *)v13 - 16i64;
if( (*(_QWORD *)v13 & 0xFFFFFFFFFFFFFFF0ui64) <= 0x10 )
v15 = 0i64;
if( (v14 & 2) != 0
|| (v16._bf_0 = *(_QWORD *)v13,
v16._bf_0 != _InterlockedCompareExchange64((volatile signed __int64 *)v13, v15, v14)) )
{
ExfReleasePushLock((_EX_PUSH_LOCK *)v13);
}
v28 = (_ETHREAD *)KeGetCurrentThread();
v29 = 0;
v39 = 0;
if( v13 >= 0xFFFF800000000000ui64 && *((_BYTE *)&stru_140C4DB30 + ((v13 >> 39) & 0x1FF) + 6872) == 1 )
v30 = MmGetSessionIdEx(v28->Tcb.ApcState.Process);
else
v30 = -1;
--v28->Tcb.SpecialApcDisable;
v31 = ++v28->Tcb.AbAllocationRegionCount;
v32 = ((char)v28->Tcb.AbEntrySummary | (char)v28->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
while( 1 )
{
v27 = !_BitScanReverse((unsigned int *)&v33, v32);
if( v27 )
goto LABEL_65;
v34 = &v28->Tcb.LockEntries[v33];
v32 &= ~(1 << v33);
if( (v34->AcquiredByte & 1) != 0
&& (v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v13 & 0x7FFFFFFFFFFFFFFCi64)
&& v34->LockState.SessionId == v30 )
{
v34->AcquiredByte &= ~1u;
if( v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
}
if( !v34 )
{
LABEL_65:
if( (*(&v28->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v28, (PVOID)v13, (PVOID)v30, 0i64);
goto LABEL_77;
}
v34->CrossThreadReleasableAndBusyByte |= 2u;
if( v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v34);
v29 = v34->BoostBitmap.AllFields & 0x1FFFF;
v35 = v34->BoostBitmap.AllFields & 0xFFFE0000;
v34->ThreadLocalFlags &= ~1u;
v39 = BYTE2(v29);
v34->BoostBitmap.AllFields = v35;
v34->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v36 = v34 - v28->Tcb.LockEntries;
if( v31 == 1 )
v28->Tcb.AbEntrySummary |= 1 << v36;
else
_InterlockedOr8((volatile signed __int8 *)&v28->Tcb.AbOrphanedEntrySummary, 1 << v36);
LABEL_77:
--v28->Tcb.AbAllocationRegionCount;
if( (v29 & 0x1FFFF) != 0 )
{
if( (v29 & 0x8000u) != 0 )
KiAbThreadUnboostIoPriority(&v28->Tcb, 0i64);
if( (v39 & 1) != 0 )
{
_InterlockedAdd(&v28->Tcb.AbCompletedIoQoSBoostCount, 0xFFFFFFFF);
PsBoostThreadIoQoS(v28, 1ui64);
}
if( (v29 & 0x7FFF) != 0 )
KiAbThreadUnboostCpuPriority(&v28->Tcb, (_KLOCK_ENTRY *)(v29 & 0x7FFF));
}
v27 = v28->Tcb.SpecialApcDisable++ == -1;
if( v27 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v28->Tcb.ApcState.ApcListHead[0].Flink != &v28->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
if( (_DWORD)v10 )
{
qword_140C4C3E0 = *((_QWORD *)&stru_140C23628 + 41929663 * (__rdtsc() >> 4) % v11 + 839);
v4 = (_QWORD *)(qword_140C4C3E0 + 112);
v5 = (char *)(qword_140C4C3E0 + 112);
if( qword_140C4C3E0 + 112 < (unsigned __int64)(qword_140C4C3E0 + 176) )
{
do
{
_mm_prefetchnta(v5);
v5 += 64;
}
while( (unsigned __int64)v5 < qword_140C4C3E0 + 176 );
}
v6 = qword_140C4C3A0;
v7 = 8i64;
do
{
v6 = __ROR8__(v6 - *v4++, qword_140C4C3A8);
v8 -= 8;
--v7;
}
while( v7 );
for( ; v8; --v8 )
{
v37 = *(unsigned __int8 *)v4;
v4 = (_QWORD *)((char *)v4 + 1);
v6 = __ROR8__(v6 - v37, qword_140C4C3A8);
}
qword_140C4C3E8 = v6;
qword_140C4C3B0 = KiQueryUnbiasedInterruptTime(1u)
+ 41929663 * (__rdtsc() >> 4) % 0x12A05F2000i64
+ 288000000000i64;
}
else
{
qword_140C4C3A0 = 0i64;
}
goto LABEL_22;
}
}
return result;
}Referenced by:
ExpInitSystemPhase1