PopEtInit

INT64 __stdcall PopEtInit(){
  unsigned int v0; 
  _OWORD *PoolWithTag; 
  _OWORD *v2; 
  __int64 v3; 
  __int64 v4; 
  INT64 v5; 
  __int64 v6; 
  __int64 v7; 
  void *i; 
  _QWORD *NextProcess; 
  WCHAR v10; 
  _QWORD *v11; 
  __int64 v12; 
  int v13; 
  struct _UNICODE_STRING DestinationString; 
  __int16 result; 
  char result_2; 
  int v18; 
  int v19; 
  int v20; 
  int v21; 
  VOID(__fastcall *v22)(INT64, INT64, INT64, INT64); 
  INT64(__fastcall *v23)(INT64); 
  v0 = 0;
  DestinationString = 0i64;
  if( PopEnergyEstimationEnabled )
  {
    PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x3B8ui64, 0x54456F50ui64);
    PopEtGlobals = (__int64)PoolWithTag;
    v2 = PoolWithTag;
    if( PoolWithTag )
    {
      memset((INT64)PoolWithTag, 0i64);
      v2[1] = 0i64;
      *((_QWORD *)v2 + 2) = 0i64;
      *((_QWORD *)v2 + 1) = v2;
      *(_QWORD *)v2 = v2;
      *(_OWORD *)((char *)v2 + 40) = 0i64;
      *((_QWORD *)v2 + 5) = 0i64;
      *((_QWORD *)v2 + 11) = PopEtInternerAllocate;
      *((_QWORD *)v2 + 12) = PopEtInternerFree;
      *((_QWORD *)v2 + 13) = PopEtInternerLock;
      *((_QWORD *)v2 + 14) = PopEtInternerUnlock;
      *((_QWORD *)v2 + 15) = PopEtInternerEntryInitialize;
      RtlInternTableInitialize((INT64)v2 + 56, (INT64)v2 + 88);
      PoEnergyContextInitialize((_QWORD *)v2 + 16);
      *((_QWORD *)PsIdleProcess + 285) = v3;
      PopEtInitializeBuiltinAppId((INT64)(v2 + 48), (INT64)L"Default");
      PopEtInitializeBuiltinAppId((INT64)(v2 + 53), (INT64)L"Overflow");
      PopEtInitializeBuiltinAppId((INT64)(v2 + 43), (INT64)L"IsrDpc");
      v5 = (INT64)(v2 + 38);
      *(_QWORD *)(*(_QWORD *)(v4 + 2280) + 448i64) = v6;
      PopEtInitializeBuiltinAppId(v5, (INT64)L"System");
      v7 = *((_QWORD *)PsInitialSystemProcess + 285);
      if( v7 )
        *(_QWORD *)(v7 + 448) = v5;
      for( i = 0i64; ; i = v11 )
      {
        NextProcess = (_QWORD *)PsGetNextProcess(i);
        v11 = NextProcess;
        if( !NextProcess )
          break;
        v12 = NextProcess[285];
        if( v12 )
        {
          if( !*(_QWORD *)(v12 + 448) )
          {
            *(_QWORD *)(v12 + 448) = PopEtGlobals + 768;
            PoEnergyContextStart(NextProcess);
          }
        }
      }
      RtlInitUnicodeString(&DestinationString, L"EnergyTracker", v10);
      memset((INT64)&result, 0i64);
      result_2 |= 4u;
      v22 = PopEtEnergyTrackerClose;
      result = 120;
      v23 = PopEtEnergyTrackerDelete;
      v20 = 1;
      v21 = 640;
      v18 = 402;
      v19 = 2031617;
      v13 = ObCreateObjectType(&DestinationString, (__int64)&result, 0i64, PopEtGlobals + 32);
      if( v13 >= 0 )
        return 0;
      return(unsigned int)v13;
    }
    else
    {
      return(unsigned int)-1073741670;
    }
  }
  return v0;
}

Referenced by: