PopEtInit

NTSTATUS __stdcall PopEtInit(){
  NTSTATUS v0; 
  VOID **PoolWithTag; 
  VOID **v2; 
  __int64 v3; 
  __int64 v4; 
  INT64 v5; 
  __int64 v6; 
  struct _PO_PROCESS_ENERGY_CONTEXT *EnergyContext; 
  _EPROCESS *i; 
  _LIST_ENTRY *NextProcess; 
  _LIST_ENTRY *v10; 
  _LIST_ENTRY *Blink; 
  int v12; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_TYPE_INITIALIZER ObjectTypeInitializer; 

  v0 = 0;
  DestinationString = 0i64;
  if( *(&stru_140C23628 + 6120) )
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x3B8ui64, 1413836624i64);
    PopEtGlobals = (__int64)PoolWithTag;
    v2 = PoolWithTag;
    if( PoolWithTag )
    {
      memset(PoolWithTag, 0i64, 0x3B8u);
      *((_OWORD *)v2 + 1) = 0i64;
      v2[2] = 0i64;
      v2[1] = v2;
      *v2 = v2;
      *(_OWORD *)(v2 + 5) = 0i64;
      v2[5] = 0i64;
      v2[11] = PopEtInternerAllocate;
      v2[12] = PopEtInternerFree;
      v2[13] = PopEtInternerLock;
      v2[14] = PopEtInternerUnlock;
      v2[15] = PopEtInternerEntryInitialize;
      RtlInternTableInitialize((INT64)(v2 + 7), (INT64)(v2 + 11));
      PoEnergyContextInitialize(v2 + 16);
      *(_QWORD *)(*(_QWORD *)&PsIdleProcess + 2280i64) = v3;
      PopEtInitializeBuiltinAppId((INT64)(v2 + 96), (INT64)L"Default");
      PopEtInitializeBuiltinAppId((INT64)(v2 + 106), (INT64)L"Overflow");
      PopEtInitializeBuiltinAppId((INT64)(v2 + 86), (INT64)L"IsrDpc");
      v5 = (INT64)(v2 + 76);
      *(_QWORD *)(*(_QWORD *)(v4 + 2280) + 448i64) = v6;
      PopEtInitializeBuiltinAppId(v5, (INT64)L"System");
      EnergyContext = PsInitialSystemProcess->EnergyContext;
      if( EnergyContext )
        *((_QWORD *)EnergyContext + 56) = v5;
      for( i = 0i64; ; i = (_EPROCESS *)v10 )
      {
        NextProcess = PsGetNextProcess(i);
        v10 = NextProcess;
        if( !NextProcess )
          break;
        Blink = NextProcess[142].Blink;
        if( Blink )
        {
          if( !Blink[28].Flink )
          {
            Blink[28].Flink = (_LIST_ENTRY *)(PopEtGlobals + 768);
            PoEnergyContextStart((ULONG_PTR)NextProcess);
          }
        }
      }
      RtlInitUnicodeString(&DestinationString, L"EnergyTracker");
      memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
      ObjectTypeInitializer._bf_0 |= 4u;
      ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))PopEtEnergyTrackerClose;
      ObjectTypeInitializer.Length = 120;
      ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))PopEtEnergyTrackerDelete;
      ObjectTypeInitializer.PoolType = PagedPool;
      ObjectTypeInitializer.DefaultPagedPoolCharge = 640;
      ObjectTypeInitializer.InvalidAttributes = 402;
      ObjectTypeInitializer.ValidAccessMask = 2031617;
      v12 = ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, (_OBJECT_TYPE **)(PopEtGlobals + 32));
      if( v12 >= 0 )
        return 0;
      return v12;
    }
    else
    {
      return -1073741670;
    }
  }
  return v0;
}

Referenced by: