WheaInitialize
NTSTATUS __stdcall WheaInitialize(_LOADER_PARAMETER_BLOCK *LoaderBlock, UINT64 Phase){
__int64 v2;
ULONG_PTR v3;
_LOADER_PARAMETER_BLOCK *v4;
int v5;
int PerProcessorInfo;
int v7;
int *v8;
unsigned int v9;
int v10;
__int64 v11;
int v12;
int v13;
_ETHREAD *CurrentThread;
unsigned __int8 v15;
__int64 v16;
__int64 v17;
__int64 v18;
__int64 v19;
int v20;
bool v21;
int v22;
unsigned int i;
__int64 v24;
INT64 j;
int v26;
INT64 v27;
int v28;
int v29;
_ETHREAD *v30;
unsigned int SessionId;
char v32;
int v33;
__int64 v34;
unsigned __int64 v35;
int v36;
unsigned int v37;
__int64 v38;
ULONG_PTR BugCheckParameter4;
ULONG_PTR BugCheckParameter4a;
unsigned int v42;
PVOID Address;
__int64 v44[2];
UINT64 Count;
int v47;
int v48;
v2 = 0i64;
v3 = (unsigned int)Phase;
Address = 0i64;
v4 = LoaderBlock;
v44[0] = 0i64;
LODWORD(Count) = 0;
if( !(_DWORD)Phase )
{
WheapStatus = 0i64;
dword_140C15F38 = 0;
WheapErrorRecordId = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
WheapLoadPolicy();
if( (*(_DWORD *)(*((_QWORD *)v4 + 30) + 132i64) & 2) == 0 )
WheapPreviousSessionFailure = 1;
v5 = PshedInitialize(v4, v44);
if( v5 < 0 )
KeBugCheckEx(0x122u, 3ui64, v5, 0i64, 0i64);
PerProcessorInfo = WheapCreatePerProcessorInfo();
if( PerProcessorInfo < 0 )
KeBugCheckEx(0x122u, 4ui64, PerProcessorInfo, 0i64, 0i64);
v7 = WheapQueryPshedForErrorSources(&Count, (UINT8 **)&Address);
if( v7 < 0 )
KeBugCheckEx(0x122u, 5ui64, v7, 0i64, 0i64);
WheapErrorSourceTable = 1279410516i64;
qword_140CDAE70 = (__int64)&qword_140CDAE68;
qword_140CDAE68 = (INT64)&qword_140CDAE68;
KeInitializeEvent(&stru_140CDAE78, SynchronizationEvent, 1u);
WheapInitializeEventing();
v8 = (int *)Address;
v9 = 0;
if( (_DWORD)Count )
{
do
{
v10 = ((__int64(__fastcall *)(_QWORD, int *, _QWORD))qword_140CF4350[8 * (__int64)v8[2] + 1])(0i64, v8, 0i64);
if( v10 < 0 )
KeBugCheckEx(0x122u, 6ui64, v10, 0i64, v8[2]);
v11 = (unsigned int)*v8;
++v9;
v8[3] = 2;
v8 = (int *)((char *)v8 + v11);
}
while( v9 < (unsigned int)Count );
v8 = (int *)Address;
}
PshedFreeMemory(v8);
return 0;
}
qword_140C15E98 = (__int64)&WheapPrevErrList;
WheapPrevErrList = (__int64)&WheapPrevErrList;
v12 = PshedInitialize(LoaderBlock, v44);
if( v12 < 0 )
KeBugCheckEx(0x122u, 3ui64, v12, 0i64, 0i64);
WheapInitializeWorkQueue();
v13 = WheapQueryPshedForErrorSources(&Count, (UINT8 **)&Address);
if( v13 < 0 )
KeBugCheckEx(0x122u, 5ui64, v13, v3, 0i64);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v42 = 0;
--*((_WORD *)CurrentThread + 243);
if( ++*((_BYTE *)CurrentThread + 794) != 1 )
KeBugCheckEx(0x192u, (ULONG_PTR)CurrentThread, (ULONG_PTR)&WheapConfigTableLock, KeGetCurrentIrql(), 0i64);
v15 = *((_BYTE *)CurrentThread + 792);
if( !v15 )
{
if( !*((_BYTE *)CurrentThread + 870) )
goto LABEL_19;
v16 = *((unsigned __int8 *)CurrentThread + 870);
*((_BYTE *)CurrentThread + 870) = 0;
v15 = v16 | *((_BYTE *)CurrentThread + 792);
}
_BitScanForward((unsigned int *)&v17, v15);
*((_BYTE *)CurrentThread + 792) = v15 & ~(1 << v17);
v2 = *((_QWORD *)CurrentThread + 100) + 96 * v17;
if( !v2 )
{
LABEL_19:
_interlockedbittestandset((volatile signed __int32 *)CurrentThread + 30, 0x10u);
goto LABEL_28;
}
if( (unsigned __int64)&WheapConfigTableLock >= 0xFFFF800000000000ui64
&& *((_BYTE *)&antNameB + (((unsigned __int64)&WheapConfigTableLock >> 39) & 0x1FF) - 256) == 1
&& (v18 = *((_QWORD *)CurrentThread + 23), (v19 = *(_QWORD *)(v18 + 1368)) != 0)
&& (*(_DWORD *)(v18 + 2172) & 0x1000) == 0 )
{
v20 = *(_DWORD *)(v19 + 8);
}
else
{
v20 = -1;
}
*(_DWORD *)(v2 + 40) = v20;
v4 = LoaderBlock;
*(_QWORD *)(v2 + 32) = (unsigned __int64)&WheapConfigTableLock & 0x7FFFFFFFFFFFFFFCi64;
LABEL_28:
--*((_BYTE *)CurrentThread + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)CurrentThread, (__int64)&WheapConfigTableLock, &v42);
v21 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
if( v21 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
KiCheckForKernelApcDelivery();
if( _interlockedbittestandset64((volatile signed __int32 *)&WheapConfigTableLock, 0i64) )
ExfAcquirePushLockExclusiveEx(&WheapConfigTableLock, (VOID *)v2, &WheapConfigTableLock);
if( v2 )
*(_BYTE *)(v2 + 26) |= 1u;
v22 = WheapInitializeErrorSourceTable((unsigned int)Count, (_WHEA_ERROR_SOURCE_DESCRIPTOR *)Address);
if( v22 < 0 )
KeBugCheckEx(0x122u, 7ui64, v22, 0i64, 0i64);
PshedFreeMemory(Address);
for( i = 0; i < (unsigned int)KeNumberProcessors_0; *(_QWORD *)(*(_QWORD *)(v24 + 33568) + 8i64) = &WheapErrorSourceTable )
{
KeGetPrcb(i++);
**(_DWORD **)(v24 + 33568) = Count;
*(_QWORD *)(*(_QWORD *)(v24 + 33568) + 16i64) = &WheapWorkQueue;
}
for( j = qword_140CDAE68; (INT64 *)j != &qword_140CDAE68; j = *(_QWORD *)j )
{
if( *(_DWORD *)(j + 104) == 7 )
{
*(_DWORD *)(j + 108) = 2;
v26 = WheapCallErrorSourceInitialize(j, (unsigned int)v3);
if( v26 < 0 )
{
BugCheckParameter4 = *(int *)(j + 104);
*(_DWORD *)(j + 108) = 1;
KeBugCheckEx(0x122u, 6ui64, v26, v3, BugCheckParameter4);
}
}
}
WheapCheckForClzeroSupport();
if( (*(_BYTE *)(*((_QWORD *)v4 + 30) + 2616i64) & 4) == 0 && PshedIsSystemWheaEnabled() )
WheapCheckForAndReportErrorsFromPreviousSession();
v27 = qword_140CDAE68;
v28 = 0;
while( (INT64 *)v27 != &qword_140CDAE68 )
{
v21 = *(_DWORD *)(v27 + 104) == 7;
*(_DWORD *)(v27 + 124) = v28;
if( !v21 && !*(_BYTE *)(v27 + 88) && *(_DWORD *)(v27 + 108) == 1 )
{
*(_DWORD *)(v27 + 108) = 2;
v29 = WheapCallErrorSourceInitialize(v27, (unsigned int)v3);
if( v29 < 0 )
{
BugCheckParameter4a = *(int *)(v27 + 104);
*(_DWORD *)(v27 + 108) = 1;
KeBugCheckEx(0x122u, 6ui64, v29, v3, BugCheckParameter4a);
}
}
v27 = *(_QWORD *)v27;
++v28;
}
WheapLogInitEvent();
WheaWmiInit();
WheapInitializationComplete = 1;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&WheapConfigTableLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&WheapConfigTableLock);
v30 = (_ETHREAD *)KeGetCurrentThread();
v48 = 0;
if( (unsigned int)MiGetSystemRegionType((UINT64)&WheapConfigTableLock) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)v30 + 23));
else
SessionId = -1;
--*((_WORD *)v30 + 243);
v32 = ++*((_BYTE *)v30 + 794);
v33 = (*((char *)v30 + 792) | *((char *)v30 + 870)) ^ 0x3F;
while( 1 )
{
v21 = !_BitScanReverse((unsigned int *)&v34, v33);
v47 = v34;
if( v21 )
break;
v35 = *((_QWORD *)v30 + 100) + 96 * v34;
v33 &= ~(1 << v34);
if( (*(_BYTE *)(v35 + 26) & 1) != 0
&& (*(_DWORD *)(v35 + 32) & 1) == 0
&& (*(_QWORD *)(v35 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&WheapConfigTableLock & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v35 + 40) == SessionId )
{
*(_BYTE *)(v35 + 26) &= ~1u;
if( *(_QWORD *)(v35 + 32) )
{
if( v35 )
{
*(_BYTE *)(v35 + 32) |= 2u;
if( *(__int64 *)(v35 + 32) < 0 )
KiAbEntryRemoveFromTree(v35);
v36 = *(_DWORD *)(v35 + 88) & 0x1FFFF;
v37 = *(_DWORD *)(v35 + 88) & 0xFFFE0000;
*(_BYTE *)(v35 + 25) &= ~1u;
v48 = v36;
*(_DWORD *)(v35 + 88) = v37;
*(_QWORD *)(v35 + 32) = 0i64;
v38 = (__int64)(v35 - *((_QWORD *)v30 + 100)) / 96;
if( v32 == 1 )
*((_BYTE *)v30 + 792) |= 1 << v38;
else
_InterlockedOr8((volatile signed __int8 *)v30 + 870, 1 << v38);
goto LABEL_70;
}
break;
}
}
}
if( (*((_DWORD *)v30 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v30, (ULONG_PTR)&WheapConfigTableLock, SessionId, 0i64);
LABEL_70:
--*((_BYTE *)v30 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v30, (__int64)&WheapConfigTableLock, (unsigned int *)&v48);
v21 = (*((_WORD *)v30 + 243))++ == 0xFFFF;
if( v21 && *((_ETHREAD **)v30 + 19) != (_ETHREAD *)((char *)v30 + 152) )
KiCheckForKernelApcDelivery();
return 0;
}Referenced by:
IoInitSystemPreDrivers