HalpCmciLoadThresholdConfiguration
NTSTATUS __stdcall HalpCmciLoadThresholdConfiguration(){
NTSTATUS result;
unsigned int v1;
VOID *SystemRoutineAddress;
int v3;
unsigned int v4;
unsigned int v5;
NTSTATUS v6;
int v7;
int v8;
int v9;
_LARGE_INTEGER PerformanceFrequency;
_UNICODE_STRING DestinationString;
__int64 v12[28];
v4 = 0;
v6 = 0;
v5 = 0;
PerformanceFrequency.QuadPart = 0i64;
result = _InterlockedCompareExchange(dword_140CED534, 1, 0);
if( !result )
{
memset(v12, 0i64, sizeof(v12));
v9 = -1;
v12[2] = (__int64)L"CMCThresholdCount";
LODWORD(v12[4]) = 67108868;
LODWORD(v12[11]) = 67108868;
v12[3] = (__int64)&v4;
v1 = 100;
LODWORD(v12[18]) = 67108868;
v12[5] = (__int64)&v7;
v8 = 60;
v12[9] = (__int64)L"CMCThresholdSeconds";
LODWORD(v12[6]) = 4;
v12[10] = (__int64)&v5;
LODWORD(v12[13]) = 4;
v12[12] = (__int64)&v8;
v12[16] = (__int64)L"CMCPollingLimit";
v12[17] = (__int64)&v6;
LODWORD(v12[20]) = 4;
v12[19] = (__int64)&v9;
v7 = 100;
LODWORD(v12[1]) = 304;
LODWORD(v12[8]) = 304;
LODWORD(v12[15]) = 304;
DestinationString = 0i64;
RtlInitUnicodeString(&DestinationString, L"RtlQueryRegistryValuesEx");
SystemRoutineAddress = MmGetSystemRoutineAddress(&DestinationString);
if( !SystemRoutineAddress )
SystemRoutineAddress = RtlQueryRegistryValues;
if( ((int(__fastcall *)(__int64, const wchar_t *, __int64 *, _QWORD, _QWORD))SystemRoutineAddress)(
2147483650i64,
L"Session Manager",
v12,
0i64,
0i64) < 0 )
{
v6 = -1;
v4 = 100;
v5 = 60;
}
else
{
v1 = v4;
}
v3 = 2;
if( v1 > 2 )
v3 = v1;
dword_140C5055C = v3;
KeQueryPerformanceCounter(&PerformanceFrequency);
qword_140C50548 = PerformanceFrequency.QuadPart * v5;
result = v6;
HalpCmcPollCount = v6;
}
return result;
}Referenced by:
HalpCmciInit