EtwpInitialize

VOID __stdcall EtwpInitialize(UINT64 Phase){
  unsigned int v1; 
  NTSTATUS v2; 
  _WORD *v3; 
  __int64 i; 
  unsigned int j; 
  _KPRCB *Prcb; 
  NTSTATUS v7; 
  INT64 v8; 
  INT64 v9; 
  VOID *ExplicitScope; 
  UINT64 MatchingChangeStamp; 
  UINT64 CheckStamp; 
  __int64 v13; 
  _UNICODE_STRING DestinationString; 
  INT64 v15[2]; 
  __int64 v16; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v18; 
  _LARGE_INTEGER BootTime; 
  UINT64 BootTimeBias; 

  v1 = KeNumberProcessors_0;
  BootTime.QuadPart = 0i64;
  BootTimeBias = 0i64;
  v16 = 0i64;
  *(_OWORD *)v15 = 0i64;
  if( (_DWORD)Phase )
  {
    if( (_DWORD)Phase == 1 )
    {
      LODWORD(ExplicitScope) = 0;
      EtwpUpdateFileInfoDriverState(
        &PerfGlobalGroupMask,
        &PerfGlobalGroupMask,
        1,
        (UINT64 *)EtwpHostSiloState,
        (UINT64)ExplicitScope);
    }
  }
  else
  {
    KeQueryBootTimeValues((_LARGE_INTEGER *)&ExBootDevicesRemovedEvent + 191, &BootTime, &BootTimeBias);
    *(&ExBootDevicesRemovedEvent + 244) = BootTime.QuadPart - BootTimeBias;
    RtlGetMultiTimePrecise((INT64)v15);
    *(&ExBootDevicesRemovedEvent + 247) = 0i64;
    *(&ExBootDevicesRemovedEvent + 246) = KeQueryPerformanceCounter(0i64);
    *(&ExBootDevicesRemovedEvent + 192) = __rdtsc();
    v2 = EtwpInitializeSecurity();
    if( v2 < 0 )
      KeBugCheckEx(0x11Du, (PVOID)1, (PVOID)v2, 0i64, 0i64);
    v3 = (_WORD *)(&KUSER_SHARED_DATA + 896);
    for( i = 9i64; i; --i )
      *v3++ = 0;
    for( j = 0; j < v1; ++j )
    {
      Prcb = KeGetPrcb(j);
      v7 = EtwInitializeProcessor(Prcb);
      if( v7 < 0 )
        KeBugCheckEx(0x11Du, (PVOID)2, (PVOID)v7, (PVOID)j, 0i64);
    }
    KeInitializeMutex((PRKMUTEX)((char *)&ExBootDevicesRemovedEvent + 2368), 0);
    KeInitializeMutex((PRKMUTEX)((char *)&ExBootDevicesRemovedEvent + 2432), 0);
    *(&ExBootDevicesRemovedEvent + 263) = 0i64;
    EtwpInitializeStackLookasideList();
    EtwpReadConfigParameters();
    EtwpInitializeRegistration();
    EtwpInitializePrivateSessionDemuxObject();
    EtwpInitializeRealTimeConnection();
    *(&ExBootDevicesRemovedEvent + 381) = KeGetPrcb(0i64)->MHz;
    KeQueryPerformanceCounter((_LARGE_INTEGER *)&ExBootDevicesRemovedEvent + 189);
    EtwpInitializeLastBranchTracing();
    EtwpInitializeProcessorTrace(v9, v8);
    *(&ExBootDevicesRemovedEvent + 292) = 0;
    *(&ExBootDevicesRemovedEvent + 186) = EtwpAdjustTraceBuffers;
    *(&ExBootDevicesRemovedEvent + 288) = 0;
    *(&ExBootDevicesRemovedEvent + 145) = 0i64;
    *(&ExBootDevicesRemovedEvent + 187) = (char *)&ExBootDevicesRemovedEvent + 1504;
    *(&ExBootDevicesRemovedEvent + 289) = 12;
    *(&ExBootDevicesRemovedEvent + 386) = 8;
    *(&ExBootDevicesRemovedEvent + 184) = 0i64;
    KeInitializeTimer2((INT64)&ExBootDevicesRemovedEvent + 2880, (INT64)EtwpLogMemInfoTimerCallback, 0i64, 8i64);
    EtwpInitializeProviderTraits();
    if( !ExRegisterCallback(*(&ExBootDevicesRemovedEvent + 16), EtwpPowerStateCallback, 0i64) )
      goto LABEL_22;
    v13 = 0i64;
    *(&ObjectAttributes.Length + 1) = 0;
    DestinationString = 0i64;
    *(&ObjectAttributes.Attributes + 1) = 0;
    if( (int)KsrGetFirmwareInformation(&v13) >= 0 )
    {
      RtlInitUnicodeString(&DestinationString, L"\\Callback\\SoftRestart");
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 80;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      if( ExCreateCallback(&EtwpKsrCallbackObject, &ObjectAttributes, 0, 1u) >= 0 )
        ExRegisterCallback(EtwpKsrCallbackObject, EtwpKsrCallback, 0i64);
    }
    EtwpLoadMicroarchitecturalPmcs();
    EtwpInitializeSiloAllowedGroupMask();
    if( EtwInitializeSiloState(0i64) < 0 )
LABEL_22:
      KeBugCheck(0x11Du);
    *(&ExBootDevicesRemovedEvent + 1324) = 0;
    KeRegisterBugCheckReasonCallback(
      (PKBUGCHECK_REASON_CALLBACK_RECORD)((char *)&ExBootDevicesRemovedEvent + 1280),
      (PKBUGCHECK_REASON_CALLBACK_ROUTINE)EtwpBugCheckMultiPartCallback,
      KbCallbackSecondaryMultiPartDumpData,
      (PUCHAR)&EtwpComponentName);
    EtwRegister(
      (_LPCGUID)&EventTracingProvGuid,
      (PETWENABLECALLBACK)EtwpTracingProvEnableCallback,
      0i64,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 241);
    WdipSemInitialize();
    PerfDiagInitialize();
    EtwpInitializeCoverage();
    EtwpInitializeCoverageSampler();
    EtwRegister(
      (_LPCGUID)&KernelProvGuid,
      (PETWENABLECALLBACK)EtwpKernelProvEnableCallback,
      0i64,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 380);
    TlgRegisterAggregateProvider((UINT64 *)&stru_140C00F40 + 910);
    EtwRegister(
      (_LPCGUID)&PsProvGuid,
      (PETWENABLECALLBACK)EtwpCrimsonProvEnableCallback,
      (PVOID)1,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 245);
    TlgRegisterAggregateProviderEx((char *)&stru_140C00F40 + 7224);
    EtwRegister(
      (_LPCGUID)&NetProvGuid,
      (PETWENABLECALLBACK)EtwpCrimsonProvEnableCallback,
      (PVOID)0x10000,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 242);
    EtwRegister(
      (_LPCGUID)&DiskProvGuid,
      (PETWENABLECALLBACK)EtwpCrimsonProvEnableCallback,
      (PVOID)0x100,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 243);
    EtwRegister(
      (_LPCGUID)&FileProvGuid,
      (PETWENABLECALLBACK)EtwpCrimsonProvEnableCallback,
      (PVOID)0x2000000,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 240);
    EtwRegister((_LPCGUID)&RegistryProvGuid, (PETWENABLECALLBACK)EtwpRegTraceEnableCallback, 0i64, &EtwpRegTraceHandle);
    EtwRegister(
      (_LPCGUID)&MemoryProvGuid,
      (PETWENABLECALLBACK)EtwpCrimsonProvEnableCallback,
      (PVOID)0x20000001,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 251);
    EtwRegister(
      (_LPCGUID)&MS_Windows_Kernel_AppCompat_Provider,
      0i64,
      0i64,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 381);
    EtwRegister((_LPCGUID)&KernelAuditApiCallsGuid, 0i64, 0i64, (PREGHANDLE)&ExBootDevicesRemovedEvent + 379);
    EtwRegister((_LPCGUID)&CVEAuditProviderGuid, 0i64, 0i64, (PREGHANDLE)&ExBootDevicesRemovedEvent + 252);
    EtwRegister((_LPCGUID)&ThreatIntProviderGuid, 0i64, 0i64, (PREGHANDLE)&ExBootDevicesRemovedEvent + 179);
    EtwRegister((_LPCGUID)&MS_Windows_Security_LPAC_Provider, 0i64, 0i64, (PREGHANDLE)&ExBootDevicesRemovedEvent + 249);
    EtwRegister(
      (_LPCGUID)&MS_Windows_Security_Adminless_Provider,
      0i64,
      0i64,
      (PREGHANDLE)&ExBootDevicesRemovedEvent + 250);
    EtwRegister((_LPCGUID)&SecurityMitigationsProviderGuid, 0i64, 0i64, (PREGHANDLE)&ExBootDevicesRemovedEvent + 248);
    LODWORD(CheckStamp) = 0;
    LODWORD(MatchingChangeStamp) = 0;
    *(&ExBootDevicesRemovedEvent + 1440) = 1;
    ZwUpdateWnfStateData(&WNF_ETW_SUBSYSTEM_INITIALIZED, 0i64, 0i64, 0i64, 0i64, MatchingChangeStamp, CheckStamp);
    EtwpTraceSystemInitialization();
    v18 = 0;
    if( ((int(__fastcall *)(__int64, __int64, int *, int *))off_140C00A68[0])(44i64, 4i64, &EtwpMaxPmcCounter, &v18) < 0 )
      EtwpMaxPmcCounter = 8;
    EtwpMaxProfilingSources = EtwpMaxPmcCounter;
  }
}

Referenced by: