TtmiCreateTerminal

NTSTATUS __stdcall TtmiCreateTerminal(
        _TTMI_SESSION *LockedSession,
        UINT64 DesiredAccess,
        INT8 PreviousMode,
        VOID **Handle,
        UINT64 *TerminalId,
        _TTMI_TERMINAL **Terminal){
  UINT64 *v6; 
  unsigned int v8; 
  unsigned int ClearBitsAndSet; 
  UINT64 v12; 
  NTSTATUS v13; 
  INT64 v14; 
  INT64 v15; 
  UINT64 v16; 
  NTSTATUS v17; 
  UINT64 *v18; 
  _ADAPTER_OBJECT *v19; 
  _TTMI_SESSION **v20; 
  NTSTATUS inserted; 
  _TTMI_TERMINAL **v22; 
  VOID *v24; 
  VOID *v25; 
  VOID *v26; 
  _TABLE_SEARCH_RESULT ObjectBodySize; 
  UINT64 ObjectBodySizea; 
  PVOID *Handlea; 
  UINT64 v30; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 

  v6 = TerminalId;
  *Handle = 0i64;
  TerminalId = 0i64;
  v8 = DesiredAccess;
  *(_DWORD *)v6 = -1;
  ClearBitsAndSet = (unsigned int)RtlFindClearBitsAndSet(
                                    (_RTL_AVL_TABLE *)(LockedSession + 14),
                                    (VOID *)1,
                                    0i64,
                                    (UINT8 *)Handle,
                                    v24,
                                    ObjectBodySize);
  if( ClearBitsAndSet == -1 )
  {
    v13 = -1073741756;
    TtmiLogError((INT8 *)"TtmiAcquireTerminalId", 0x643ui64, 0xFFFFFFFFi64, 3221225540i64);
    v14 = 3221225540i64;
    v15 = 3221225540i64;
    v16 = 581i64;
LABEL_3:
    TtmiLogError((INT8 *)"TtmiCreateTerminal", v16, v15, v14);
    return v13;
  }
  LOBYTE(v12) = PreviousMode;
  LODWORD(v30) = 0;
  LODWORD(Handlea) = 0;
  memset(&ObjectAttributes.ObjectName, 0, 32);
  ObjectAttributes.Attributes = PreviousMode == 0 ? 0x200 : 0;
  *(_OWORD *)&ObjectAttributes.Length = 0i64;
  ObjectAttributes.Length = 48;
  LODWORD(ObjectBodySizea) = 288;
  v17 = ObCreateObjectEx(
          0i64,
          TtmpTerminalObjectType,
          &ObjectAttributes,
          v12,
          v25,
          ObjectBodySizea,
          (UINT64)Handlea,
          v30,
          (VOID **)&TerminalId,
          0i64);
  v13 = v17;
  if( v17 < 0 )
  {
    v14 = (unsigned int)v17;
    v15 = (unsigned int)v17;
    v16 = 614i64;
    _bittestandreset(*((signed __int32 **)LockedSession + 8), ClearBitsAndSet);
    goto LABEL_3;
  }
  v18 = TerminalId;
  ObfReferenceObject(TerminalId);
  memset(v18, 0i64, 0x120u);
  *((_DWORD *)v18 + 6) = 1416459348;
  *((_DWORD *)v18 + 7) = ClearBitsAndSet;
  if( ClearBitsAndSet )
  {
    *((_DWORD *)v18 + 10) = 1;
    *((_DWORD *)v18 + 69) = 1;
    *((_DWORD *)v18 + 12) = 2;
    v18[9] = 300000000i64;
  }
  else
  {
    *((_DWORD *)v18 + 10) = 3;
    *((_DWORD *)v18 + 69) = 3;
    *((_DWORD *)v18 + 12) = 0;
    *((_DWORD *)v18 + 9) |= 0x10u;
    v18 = TerminalId;
    TerminalId[10] = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
    TtmiUpdateActiveTerminalCount(LockedSession, 1u, MonitorRequestReasonTerminal);
  }
  KeInitializeTimerEx((INT64)(v18 + 11), 0);
  KeInitializeDpc((PRKDPC)(v18 + 19), TtmpScheduledEvaluationDpc, v18);
  v18[27] = 0i64;
  v18[29] = (UINT64)TtmpScheduledEvaluationWorker;
  v18[30] = (UINT64)v18;
  _InterlockedAdd(LockedSession + 2, 1u);
  v19 = (_ADAPTER_OBJECT *)TerminalId;
  TerminalId[2] = (UINT64)LockedSession;
  v20 = (_TTMI_SESSION **)*((_QWORD *)LockedSession + 6);
  if( *v20 != LockedSession + 10 )
    __fastfail(3u);
  v19->AdapterObject.DmaHeader.DmaOperations = (_DMA_OPERATIONS *)v20;
  *(_QWORD *)&v19->AdapterObject.DmaHeader.Version = LockedSession + 10;
  *v20 = (_TTMI_SESSION *)v19;
  *((_QWORD *)LockedSession + 6) = v19;
  TtmiLogTerminalCreated(v19, ClearBitsAndSet);
  LODWORD(v26) = 0;
  inserted = ObInsertObjectEx(v19, 0i64, v8, 1ui64, (UINT64)v26, 0i64, Handle);
  v13 = inserted;
  if( inserted >= 0 )
  {
    v22 = Terminal;
    *(_DWORD *)v6 = ClearBitsAndSet;
    if( v22 )
      *v22 = (_TTMI_TERMINAL *)v19;
    else
      HalPutDmaAdapter(v19);
    return 0;
  }
  else
  {
    TtmiLogError((INT8 *)"TtmiCreateTerminal", 0x2C1ui64, (unsigned int)inserted, (unsigned int)inserted);
    TtmpSetTerminalPendingCleanup(LockedSession, (_TTMI_TERMINAL *)v19);
  }
  return v13;
}

Referenced by: