PopUmpoInitializeMonitorChannel
INT64 __fastcall PopUmpoInitializeMonitorChannel(){
WCHAR v0;
PCALLBACK_OBJECT v1;
PVOID v2;
int v3;
int v4;
NTSTATUS v5;
int v6;
PCALLBACK_OBJECT CallbackObject;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
INT64 a3[2];
struct _UNICODE_STRING DestinationString;
INT64 result[10];
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
v1 = 0i64;
PopAlpcMonitorServerPort = 0i64;
v2 = 0i64;
PopAlpcMonitorClientPort = 0i64;
*(_OWORD *)a3 = 0i64;
CallbackObject = 0i64;
DestinationString = 0i64;
RtlInitUnicodeString(&DestinationString, L"\\PowerMonitorPort", v0);
memset((INT64)result, 0i64);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
LODWORD(result[0]) = 0x100000;
result[2] = 256i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 512;
ZwAlpcCreatePort();
v4 = v3;
if( v3 >= 0 )
{
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = 0i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 512;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v5 = ExCreateCallback(&CallbackObject, &ObjectAttributes, 1u, 1u);
v1 = CallbackObject;
v4 = v5;
if( v5 >= 0 )
{
v2 = ExRegisterCallback(CallbackObject, PopMonitorAlpcCallback, 0i64);
if( !v2 )
goto LABEL_6;
a3[0] = (INT64)v1;
a3[1] = (INT64)PopAlpcMonitorServerPort;
ZwAlpcSetInformation((INT64)PopAlpcMonitorServerPort, 9i64, (INT64)a3, 16i64, (CHAR)CallbackObject);
v4 = v6;
ObfDereferenceObjectWithTag(v1, 0x746C6644ui64);
if( v4 >= 0 )
{
PopMonitorProcessLoop();
v4 = 0;
LABEL_6:
if( v4 >= 0 )
return(unsigned int)v4;
}
}
}
if( PopAlpcMonitorServerPort )
ZwClose(PopAlpcMonitorServerPort);
if( v2 )
ExUnregisterCallback(v2);
if( v1 )
ObfDereferenceObjectWithTag(v1, 0x746C6644ui64);
return(unsigned int)v4;
}Referenced by:
PoInitSystem