VfPoolInitPhase1
VOID __stdcall VfPoolInitPhase1(){
volatile __int32 *v0;
_HANDLE v1;
_OBJECT_ATTRIBUTES ObjectAttributes;
void *ThreadHandle;
PVOID Object;
ThreadHandle = 0i64;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
if( (MmVerifierData & 0x400000) == 0 || (MmVerifierData & 1) != 0 )
{
v0 = (volatile __int32 *)&unk_140CEC868;
do
{
KeInitializeEvent((INT64)(v0 - 6), 1, 0);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = 0i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 512;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
if( PsCreateSystemThread(
&ThreadHandle,
0,
&ObjectAttributes,
0,
0i64,
ViPoolDelayFreeTrimThreadRoutine,
(PVOID)(v0 - 10)) >= 0 )
{
Object = 0i64;
ObReferenceObjectByHandle(ThreadHandle, 0i64, (_OBJECT_TYPE *)PsThreadType, 0, &Object, 0i64);
v1 = (int)ThreadHandle;
*(_QWORD *)v0 = Object;
ZwClose(v1);
InitializeSListHead((PSLIST_HEADER)(v0 - 10));
_InterlockedExchange(v0 + 2, 1);
}
v0 += 16;
}
while( (__int64)v0 < (__int64)&unk_140CEC8E8 );
}
}Referenced by:
VfInitSystemNoRebootNeeded
ViInitSystemPhase1