ExpTimerInitialization
UINT8 __stdcall ExpTimerInitialization(){
NTSTATUS v0;
_UNICODE_STRING DestinationString;
_OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;
*(&WheapDeferredInternalLogsEventLock + 364) = 0i64;
*(&WheapDeferredInternalLogsEventLock + 367) = (char *)&WheapDeferredInternalLogsEventLock + 2928;
*(&WheapDeferredInternalLogsEventLock + 366) = (char *)&WheapDeferredInternalLogsEventLock + 2928;
DestinationString = 0i64;
RtlInitUnicodeString(&DestinationString, L"Timer");
memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
ObjectTypeInitializer.Length = 120;
ObjectTypeInitializer.InvalidAttributes = 256;
ObjectTypeInitializer.PoolType = NonPagedPoolNx;
ObjectTypeInitializer.DefaultNonPagedPoolCharge = 328;
ObjectTypeInitializer.ValidAccessMask = 2031619;
ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)ExpTimerMapping;
ObjectTypeInitializer.DeleteProcedure = ExpDeleteTimer;
v0 = ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &ExTimerObjectType);
if( v0 >= 0 )
{
RtlInitUnicodeString(&DestinationString, L"IRTimer");
ObjectTypeInitializer.DefaultNonPagedPoolCharge = 168;
ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))ExpDeleteTimer2;
v0 = ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &ExpIRTimerObjectType);
ExpTimerFreedCookie = ExGenRandom(ExGenRandomDomainKernel);
}
return v0 >= 0;
}Referenced by:
ExpInitSystemPhase1