EtwInitializeSiloState

NTSTATUS __stdcall EtwInitializeSiloState(_EJOB *ServerSilo){
  VOID **PoolWithTag; 
  NTSTATUS v3; 
  __int64 v4; 
  __int64 v5; 
  WCHAR v6; 
  unsigned int v7; 
  unsigned int v8; 
  size_t v9; 
  VOID **v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  _WORD *v16; 
  _QWORD *v17; 
  __int64 v18; 
  _QWORD *v19; 
  __int64 v20; 
  __int64 v21; 
  size_t v22; 
  VOID **v23; 
  __int64 v24; 
  _EJOB *v25; 
  UINT8 IsHostSilo; 
  _EJOB *v27; 
  _EJOB *v28; 
  _ETHREAD *CurrentThread; 
  __int64 v30; 
  unsigned int i; 
  __int64 v33; 
  void *v34; 
  void *v35; 
  void *v36; 

  PoolWithTag = ExAllocatePoolWithTag(0x204ui64, 0x1220ui64, 1635218501i64);
  v3 = 0;
  v4 = (__int64)PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  memset(PoolWithTag + 1, 0i64, 0x1218u);
  *(_QWORD *)v4 = ServerSilo;
  *(_QWORD *)(v4 + 8) = PsGetServerSiloGlobals(ServerSilo);
  EtwpReadPerSiloConfigParameters(v4, v5, v6);
  KeQueryMaximumProcessorCountEx(0xFFFFu);
  v8 = v7;
  v9 = v7 * (24 * *(_DWORD *)(v4 + 16) + 64);
  v10 = ExAllocatePoolWithTag(0x204ui64, v9, 1635218501i64);
  *(_QWORD *)(v4 + 4136) = v10;
  if( !v10 )
    goto LABEL_29;
  memset(v10, 0i64, v9);
  v11 = v8;
  v12 = *(_QWORD *)(v4 + 4136) + ((unsigned __int64)v8 << 6);
  if( v8 )
  {
    v13 = 0i64;
    do
    {
      *(_QWORD *)(v13 + *(_QWORD *)(v4 + 4136)) = v12;
      v13 += 64i64;
      v14 = v12 + 8i64 * *(unsigned int *)(v4 + 16);
      *(_QWORD *)(v13 + *(_QWORD *)(v4 + 4136) - 56) = v14;
      v15 = v14 + 8i64 * *(unsigned int *)(v4 + 16);
      *(_QWORD *)(v13 + *(_QWORD *)(v4 + 4136) - 48) = v15;
      v12 = v15 + 8i64 * *(unsigned int *)(v4 + 16);
      --v11;
    }
    while( v11 );
  }
  v16 = (_WORD *)(v4 + 4048);
  *(_WORD *)(v4 + 4048) = 3;
  v17 = (_QWORD *)(v4 + 464);
  v18 = 64i64;
  do
  {
    v17[6] = 0i64;
    v19 = v17;
    v20 = 3i64;
    do
    {
      v19[1] = v19;
      *v19 = v19;
      v19 += 2;
      --v20;
    }
    while( v20 );
    v17 += 7;
    --v18;
  }
  while( v18 );
  v21 = (unsigned int)(8 * *(_DWORD *)(v4 + 16));
  v22 = 16 * *(_DWORD *)(v4 + 16);
  v23 = ExAllocatePoolWithTag(0x204ui64, v22, 1635218501i64);
  *(_QWORD *)(v4 + 448) = v23;
  if( !v23 )
  {
LABEL_29:
    v34 = *(void **)(v4 + 4136);
    if( v34 )
      ExFreePoolWithTag(v34, 0x61777445u);
    v35 = *(void **)(v4 + 448);
    if( v35 )
      ExFreePoolWithTag(v35, 0x61777445u);
    v36 = *(void **)(v4 + 4192);
    if( v36 )
      ExFreePoolWithTag(v36, 0x61777445u);
    ExFreePoolWithTag((PVOID)v4, 0x61777445u);
    return -1073741801;
  }
  *(_QWORD *)(v4 + 456) = (char *)v23 + v21;
  memset(v23, 0i64, v22);
  v24 = 0i64;
  if( *(_DWORD *)(v4 + 16) )
  {
    while( 1 )
    {
      *(_QWORD *)(*(_QWORD *)(v4 + 456) + 8 * v24) = 1i64;
      *(_QWORD *)(*(_QWORD *)(v4 + 448) + 8 * v24) = ExAllocateCacheAwareRundownProtection(
                                                       NonPagedPoolNx,
                                                       0x63777445ui64);
      if( !*(_QWORD *)(*(_QWORD *)(v4 + 448) + 8 * v24) )
        break;
      v24 = (unsigned int)(v24 + 1);
      if( (unsigned int)v24 >= *(_DWORD *)(v4 + 16) )
        goto LABEL_14;
    }
    if( (_DWORD)v24 )
    {
      v33 = 0i64;
      do
      {
        ExFreeCacheAwareRundownProtection(*(_QWORD *)(*(_QWORD *)(v4 + 448) + v33));
        v33 += 8i64;
        --v24;
      }
      while( v24 );
    }
    goto LABEL_29;
  }
LABEL_14:
  *(_QWORD *)(v4 + 416) = v4;
  *(_QWORD *)(v4 + 432) = 0i64;
  *(_OWORD *)(v4 + 64) = SecurityProviderGuid;
  KeInitializeMutex((PRKMUTEX)(v4 + 4584), 0);
  PsGetServerSiloGlobals(ServerSilo)->EtwSiloState = (_ETW_SILODRIVERSTATE *)v4;
  IsHostSilo = PsIsHostSilo(v25);
  if( IsHostSilo )
  {
    qword_140C10DC8 = *(_QWORD *)(v4 + 456);
    EtwpHostSiloState = v4;
    qword_140C10DD0 = v4;
    ExSubscribeWnfStateChange(
      (INT8 **)(v4 + 4144),
      (INT64 *)&WNF_CONT_RESTORE_FROM_SNAPSHOT_COMPLETE,
      1i64,
      0i64,
      (INT64)EtwpContainerResumeWnfCallback,
      0i64);
  }
  LODWORD(v27) = PsAttachSiloToCurrentThread((INT64)ServerSilo);
  v28 = v27;
  EtwpQueryPartitionRegistryInformation(
    (GUID *)(v4 + 4152),
    (PVOID *)(v4 + 4192),
    (_WORD *)(v4 + 4200),
    (_DWORD *)(v4 + 4204),
    v4 + 4184,
    v4 + 4168);
  if( IsHostSilo )
    qword_140D577C8 = KeQueryPerformanceCounter(0i64);
  EtwpInitializeAutoLoggers();
  if( IsHostSilo )
    qword_140D577D0 = KeQueryPerformanceCounter(0i64);
  PsDetachSiloFromCurrentThread(v28);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(v4 + 432), 0i64);
  v30 = v4 + 156;
  *(_QWORD *)(v4 + 440) = KeGetCurrentThread();
  for( i = 0; i < 8; ++i )
  {
    if( *v16 )
    {
      *(_WORD *)(v30 + 2) = *v16;
      *(_DWORD *)(v30 - 4) = 1;
      *(_BYTE *)v30 = -1;
      *(_QWORD *)(v30 + 12) = -1i64;
      *(_QWORD *)(v30 + 20) = 0i64;
      *(_DWORD *)(v30 + 4) = 64;
      *(_BYTE *)(v4 + 4064) |= 1 << i;
    }
    ++v16;
    v30 += 32i64;
  }
  *(_QWORD *)(v4 + 440) = 0i64;
  ExReleasePushLockEx(v4 + 432, 0);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  *(_QWORD *)(v4 + 4096) = 0i64;
  *(_QWORD *)(v4 + 4080) = 0i64;
  *(_QWORD *)(v4 + 4088) = 0i64;
  return v3;
}

Referenced by: