TtmInit

VOID __stdcall TtmInit(){
  __int64 v0; 
  const wchar_t *v1; 
  __int64 v2; 
  NTSTATUS v3; 
  __int64 v4; 
  const wchar_t *v5; 
  __int64 v6; 
  NTSTATUS v7; 
  _UNICODE_STRING TypeName; 
  _OBJECT_TYPE_INITIALIZER ObjectTypeInitializer; 

  if( TtmpEnabled == 1 )
  {
    memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
    ObjectTypeInitializer.Length = 120;
    ObjectTypeInitializer.InvalidAttributes = 400;
    ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0xF1 | 2;
    v0 = 0x7FFFi64;
    ObjectTypeInitializer.ValidAccessMask = 2031619;
    ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))TtmpOpenQueueHandle;
    ObjectTypeInitializer.PoolType = NonPagedPoolNx;
    ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))TtmpCloseQueueHandle;
    ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)TtmpQueueMapping;
    ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))TtmpDeleteQueue;
    v1 = L"TerminalEventQueue";
    ObjectTypeInitializer.DefaultNonPagedPoolCharge = 176;
    TypeName = 0i64;
    do
    {
      if( !*v1 )
        break;
      ++v1;
      --v0;
    }
    while( v0 );
    v2 = (0x7FFF - v0) & ((unsigned __int128)-(__int128)(unsigned __int64)v0 >> 64);
    if( v0 )
    {
      TypeName.Buffer = L"TerminalEventQueue";
      TypeName.Length = 2 * v2;
      TypeName.MaximumLength = 2 * v2 + 2;
    }
    v3 = ObCreateObjectTypeEx(&TypeName, &ObjectTypeInitializer, 0i64, 128i64, &TtmpQueueObjectType);
    if( v3 < 0 )
      KeBugCheckEx(0x19Bu, (PVOID)2, (PVOID)v3, 0i64, 0i64);
  }
  else
  {
    TtmpQueueObjectType = 0i64;
  }
  ExInitializeResourceLite((INT64)&TtmpSessionLock);
  TtmpSession = 0i64;
  if( TtmpEnabled == 1 )
  {
    if( !TtmpProximityEscapeMsec )
      TtmpProximityEscapeMsec = 3000;
    memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
    ObjectTypeInitializer.Length = 120;
    ObjectTypeInitializer.InvalidAttributes = 400;
    ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0xF1 | 6;
    v4 = 0x7FFFi64;
    ObjectTypeInitializer.ValidAccessMask = 2031619;
    ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))TtmpOpenTerminalHandle;
    ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))TtmpCloseTerminalHandle;
    ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)TtmpTerminalMapping;
    ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))TtmpDeleteTerminal;
    v5 = L"Terminal";
    ObjectTypeInitializer.PoolType = NonPagedPoolNx;
    ObjectTypeInitializer.DefaultNonPagedPoolCharge = 288;
    TypeName = 0i64;
    do
    {
      if( !*v5 )
        break;
      ++v5;
      --v4;
    }
    while( v4 );
    v6 = (0x7FFF - v4) & -(__int64)(v4 != 0);
    if( v4 )
    {
      TypeName.Buffer = L"Terminal";
      TypeName.Length = 2 * v6;
      TypeName.MaximumLength = 2 * v6 + 2;
    }
    v7 = ObCreateObjectTypeEx(&TypeName, &ObjectTypeInitializer, 0i64, 0i64, &TtmpTerminalObjectType);
    if( v7 < 0 )
      KeBugCheckEx(0x19Bu, (PVOID)1, (PVOID)v7, 0i64, 0i64);
  }
  else
  {
    TtmpTerminalObjectType = 0i64;
  }
  TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(&dword_140D2C8E8);
  TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(&dword_140D2C8B0);
}

Referenced by: