PopEtEnergyTrackerCreate

NTSTATUS __stdcall PopEtEnergyTrackerCreate(INT64 *a1, VOID **a2){
  UINT64 v2; 
  int v3; 
  bool v6; 
  int inserted; 
  char *v8; 
  _ADAPTER_OBJECT *v9; 
  UINT64 UnbiasedInterruptTime; 
  _POP_RW_LOCK *v11; 
  _POP_RW_LOCK *v12; 
  _ADAPTER_OBJECT **v13; 
  _EPROCESS *v14; 
  VOID *v15; 
  int v16; 
  PVOID v17; 
  VOID *Flags; 
  VOID *Flagsa; 
  UINT64 Flagsb; 
  UINT64 ObjectBodySize; 
  UINT64 PagedPoolCharge; 
  UINT64 NonPagedPoolCharge; 
  int CallBack[4]; 
  __int128 v26; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID Object; 
  PVOID Handle; 

  v3 = *(_DWORD *)a1;
  Object = 0i64;
  Handle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  *(_OWORD *)CallBack = 0i64;
  v26 = 0i64;
  if( (unsigned int)(v3 - 1) > 0x3FFFF )
    *(_DWORD *)a1 = 0x40000;
  if( !PopEtGlobals )
    return -1073741637;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  v6 = KeGetCurrentThread()->PreviousMode != 0;
  ObjectAttributes.ObjectName = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.Attributes = v6 ? 0 : 0x200;
  LOBYTE(v2) = KeGetCurrentThread()->PreviousMode;
  LODWORD(NonPagedPoolCharge) = 0;
  LODWORD(PagedPoolCharge) = 0;
  LODWORD(ObjectBodySize) = 640;
  inserted = ObCreateObjectEx(
               0i64,
               *(_OBJECT_TYPE **)(PopEtGlobals + 32),
               &ObjectAttributes,
               v2,
               Flags,
               ObjectBodySize,
               PagedPoolCharge,
               NonPagedPoolCharge,
               &Object,
               0i64);
  if( inserted < 0 )
  {
    v9 = (_ADAPTER_OBJECT *)Object;
  }
  else
  {
    v8 = (char *)Object;
    memset(Object, 0i64, 0x280u);
    *((_OWORD *)v8 + 1) = 0i64;
    *((_QWORD *)v8 + 2) = 0i64;
    *((_QWORD *)v8 + 8) = 0i64;
    *((_QWORD *)v8 + 9) = 0i64;
    *((_QWORD *)v8 + 6) = 0i64;
    *((_QWORD *)v8 + 7) = 0i64;
    memset(v8 + 80, 0i64, 0x200u);
    *((_QWORD *)v8 + 12) = PopEtGlobals + 848;
    *((_QWORD *)v8 + 4) = *a1;
    *((_DWORD *)v8 + 10) = *((_DWORD *)a1 + 2);
    *((_DWORD *)v8 + 159) |= 1u;
    v9 = (_ADAPTER_OBJECT *)Object;
    *((_DWORD *)Object + 148) = (KUSER_SHARED_DATA.TickCountQuad * KUSER_SHARED_DATA.TickCountMultiplier) >> 24;
    UnbiasedInterruptTime = KiQueryUnbiasedInterruptTime(1u);
    v11 = (_POP_RW_LOCK *)(PopEtGlobals + 16);
    HIDWORD(v9->LowMemoryLogicalAddressQueueEntry.ListEntry.Flink) = UnbiasedInterruptTime / 0x2710;
    LODWORD(v9->LowMemoryLogicalAddressQueueEntry.ListEntry.Blink) = 1;
    PopAcquireRwLockExclusive(v11);
    v12 = (_POP_RW_LOCK *)PopEtGlobals;
    v13 = *(_ADAPTER_OBJECT ***)(PopEtGlobals + 8);
    if( *v13 != (_ADAPTER_OBJECT *)PopEtGlobals )
      __fastfail(3u);
    *(_QWORD *)&v9->AdapterObject.DmaHeader.Version = PopEtGlobals;
    v9->AdapterObject.DmaHeader.DmaOperations = (_DMA_OPERATIONS *)v13;
    *v13 = v9;
    v12->Thread = (_ETHREAD *)v9;
    PopReleaseRwLock(v12 + 1);
    *(_QWORD *)&CallBack[1] = 0i64;
    CallBack[3] = 0;
    CallBack[0] = 1;
    v26 = (unsigned __int64)v9;
    inserted = PsEnumProcesses((INT64)PopEtProcessEnumSnapshotCallback, (INT64 *)CallBack, v14, v15, Flagsa);
    if( inserted >= 0 )
    {
      PopAcquireRwLockExclusive((_POP_RW_LOCK *)v8 + 1);
      v16 = *((_DWORD *)&v9->LowMemoryLogicalAddressQueueEntry.EntryType + 1);
      if( !v16 )
        *((_DWORD *)v8 + 159) &= ~1u;
      PopReleaseRwLock((_POP_RW_LOCK *)v8 + 1);
      if( v16 )
      {
        inserted = -1073741670;
      }
      else
      {
        LODWORD(Flagsb) = 0;
        inserted = ObInsertObjectEx(v9, 0i64, 1ui64, 1ui64, Flagsb, 0i64, &Handle);
        if( inserted < 0 )
        {
          v17 = Handle;
          v9 = 0i64;
        }
        else
        {
          v17 = 0i64;
          *a2 = Handle;
          inserted = 0;
        }
        if( v17 )
          NtClose((UINT64)v17);
      }
    }
  }
  if( v9 )
    HalPutDmaAdapter(v9);
  return inserted;
}

Referenced by: