NtCreateWorkerFactory
NTSTATUS __fastcall NtCreateWorkerFactory(
void **a1,
ACCESS_MASK a2,
__int64 a3,
void *a4,
HANDLE Handle,
__int64 a6,
__int64 a7,
int a8,
__int64 a9,
__int64 a10){
KPROCESSOR_MODE v14;
__int64 v15;
_IO_MINI_COMPLETION_PACKET_USER *PoolWithQuotaTag;
_IO_MINI_COMPLETION_PACKET_USER *v17;
UINT8 v18;
int v19;
_DISPATCHER_HEADER *v20;
PVOID v21;
void *v22;
void *v23;
__int64 v24;
_WNF_STATE_NAME_LIFETIME v25;
_WNF_DATA_SCOPE v26;
UINT8 v27;
char *v28;
__int64 v29;
__int64 v30;
PVOID v31;
NTSTATUS result;
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
POBJECT_HANDLE_INFORMATION v35;
HANDLE v36;
PVOID v37;
PVOID v38;
PVOID v39;
PVOID v40;
_EXT_SET_PARAMETERS_V0 Parameters;
v36 = 0i64;
v39 = 0i64;
v40 = 0i64;
v38 = 0i64;
v14 = *((_BYTE *)KeGetCurrentThread() + 562);
if( v14 )
{
v15 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)a1 < 0x7FFFFFFF0000i64 )
v15 = (__int64)a1;
*(_QWORD *)v15 = *(_QWORD *)v15;
}
PoolWithQuotaTag = (_IO_MINI_COMPLETION_PACKET_USER *)ExAllocatePoolWithQuotaTag(
(POOL_TYPE)520,
0x28ui64,
0x63577054ui64);
v17 = PoolWithQuotaTag;
if( !PoolWithQuotaTag )
return -1073741801;
PoolWithQuotaTag->ListEntry.Flink = 0i64;
PoolWithQuotaTag->KeyContext = 0i64;
LOWORD(PoolWithQuotaTag->ApcContext) = 0;
BYTE2(PoolWithQuotaTag->ApcContext) = 0;
v37 = 0i64;
v19 = ObReferenceObjectByHandle(a4, 2u, IoCompletionObjectType, v14, &v37, 0i64);
v20 = (_DISPATCHER_HEADER *)v37;
v17->ListEntry.Blink = (_LIST_ENTRY *)v37;
if( v19 < 0 )
{
LABEL_26:
ExFreePoolWithTag(v17, 0);
return v19;
}
KeDisableQueueingPriorityIncrement(v20, v18);
v19 = ObReferenceObjectByHandleWithTag(Handle, 0x2Au, (POBJECT_TYPE)PsProcessType, v14, 0x66577845u, &v38, 0i64);
if( v19 < 0 )
{
LABEL_25:
HalPutDmaAdapter((PADAPTER_OBJECT)v17->ListEntry.Blink);
goto LABEL_26;
}
v21 = v38;
if( *((PVOID *)KeGetCurrentThread() + 23) != v38 )
{
v19 = -1073741811;
goto LABEL_24;
}
v19 = ObOpenObjectByPointer(v38, 0x200u, 0i64, 0x2Au, (POBJECT_TYPE)PsProcessType, 0, &v36);
if( v19 < 0 )
{
LABEL_24:
ObfDereferenceObjectWithTag(v21, 0x66577845ui64);
goto LABEL_25;
}
IoAllocateMiniCompletionPacket(ExpWorkerFactoryCompletionPacketRoutine, v17, v22, v23);
*(_QWORD *)&v17->PacketType = v24;
if( !v24 )
{
v19 = -1073741801;
LABEL_23:
ObCloseHandle(v36, 0);
goto LABEL_24;
}
v19 = ObCreateObject(v14, ExpWorkerFactoryObjectType, a3, v14, 0, 576, 0, 0, &v39);
if( v19 < 0 )
{
IoFreeMiniCompletionPacket(
*(_WNF_STATE_NAME **)&v17->PacketType,
v25,
v26,
v27,
(const _WNF_TYPE_ID *)Object,
(UINT64)HandleInformation,
v35);
goto LABEL_23;
}
v28 = (char *)v39;
*((_QWORD *)v39 + 2) = v17;
*((_QWORD *)v28 + 14) = -10000000i64 * ExpWorkerFactoryThreadIdleTimeoutInSeconds;
*((_DWORD *)v28 + 70) = 0;
*((_DWORD *)v28 + 71) = a8;
*((_DWORD *)v28 + 75) = 0;
*((_QWORD *)v28 + 36) = 0i64;
v29 = 0x10000i64;
if( a9 )
v29 = a9;
*((_QWORD *)v28 + 7) = v29;
memset((INT64)(v28 + 120), 0i64);
*((_QWORD *)v28 + 39) = 0i64;
v30 = 4096i64;
if( a10 )
v30 = a10;
*((_QWORD *)v28 + 8) = v30;
*((_QWORD *)v28 + 3) = a6;
*((_QWORD *)v28 + 4) = a7;
*((_QWORD *)v28 + 38) = 0i64;
*((_DWORD *)v28 + 80) = 0;
*((_QWORD *)v28 + 5) = v36;
*((_QWORD *)v28 + 6) = v21;
*((_DWORD *)v28 + 74) = 0;
*((_DWORD *)v28 + 142) = 0;
*((_DWORD *)v28 + 128) = 1;
KeInitializeTimer2((INT64)(v28 + 328), 0i64, 0i64, 8i64);
ExpInitializeThreadHistory((INT64)v28);
*((_QWORD *)v28 + 13) = 0i64;
ObfReferenceObject(v31);
KeRegisterObjectNotification(v28 + 328, &ExpWorkerFactoryManagerQueue, (_KWAIT_BLOCK *)(v28 + 464));
*(_QWORD *)&Parameters.Version = 0i64;
Parameters.NoWakeTolerance = -1i64;
KeSetTimer2((_KTIMER2 *)(v28 + 328), *((_QWORD *)v28 + 14), -*((_QWORD *)v28 + 14), &Parameters);
result = ObInsertObject(v28, 0i64, a2, 0i64, 0i64, &v40);
if( result >= 0 )
*a1 = v40;
return result;
}Referenced by:
No references.