ExpWin32Initialization

UINT8 __stdcall ExpWin32Initialization(){
  NTSTATUS v0; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_TYPE_INITIALIZER ObjectTypeInitializer; 

  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"WindowStation");
  memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
  ObjectTypeInitializer.Length = 120;
  ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))ExpWin32CloseProcedure;
  ObjectTypeInitializer.PoolType = NonPagedPoolNx;
  ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))ExpWin32DeleteProcedure;
  ObjectTypeInitializer.InvalidAttributes = 304;
  ObjectTypeInitializer.OkayToCloseProcedure = (unsigned __int8(__fastcall *)(_EPROCESS *, void *, void *, char))ExpWin32OkayToCloseProcedure;
  ObjectTypeInitializer.ValidAccessMask = 983040;
  ObjectTypeInitializer.ParseProcedure = (int(__fastcall *)(void *, void *, _ACCESS_STATE *, char, unsigned int, _UNICODE_STRING *, _UNICODE_STRING *, void *, _SECURITY_QUALITY_OF_SERVICE *, void **))ExpWin32ParseProcedure;
  ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))ExpWin32OpenProcedure;
  ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0xA7 | 0x18;
  ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)ExpWindowStationMapping;
  if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &ExWindowStationObjectType) < 0 )
    return 0;
  RtlInitUnicodeString(&DestinationString, L"Desktop");
  ObjectTypeInitializer._bf_0 |= 0x40u;
  ObjectTypeInitializer.ParseProcedure = 0i64;
  ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)ExpDesktopMapping;
  if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, (_OBJECT_TYPE **)&ExDesktopObjectType) < 0 )
    return 0;
  RtlInitUnicodeString(&DestinationString, L"Composition");
  ObjectTypeInitializer.ParseProcedure = 0i64;
  ObjectTypeInitializer.ObjectTypeCode = 1024;
  ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0xBD | 2;
  ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)ExpCompositionMapping;
  v0 = ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &ExCompositionObjectType);
  ObjectTypeInitializer.ObjectTypeCode = 0;
  if( v0 < 0 )
    return 0;
  RtlInitUnicodeString(&DestinationString, L"RawInputManager");
  ObjectTypeInitializer.ParseProcedure = 0i64;
  ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0xBD | 2;
  ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)ExpRawInputManagerMapping;
  if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &ExRawInputManagerObjectType) < 0 )
    return 0;
  RtlInitUnicodeString(&DestinationString, L"CoreMessaging");
  ObjectTypeInitializer.ParseProcedure = 0i64;
  ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0xBD | 2;
  ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)ExpCoreMessagingMapping;
  if( ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &ExCoreMessagingObjectType) < 0 )
    return 0;
  RtlInitUnicodeString(&DestinationString, L"ActivationObject");
  ObjectTypeInitializer.ParseProcedure = 0i64;
  ObjectTypeInitializer.PoolType = NonPagedPoolSessionNx|PagedPool;
  ObjectTypeInitializer._bf_0 = ObjectTypeInitializer._bf_0 & 0xB9 | 6;
  ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)ExpActivationObjectMapping;
  return ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &ExActivationObjectType) >= 0;
}

Referenced by: