PopUmpoInitializeMonitorChannel
NTSTATUS __stdcall PopUmpoInitializeMonitorChannel(){
PCALLBACK_OBJECT v0;
VOID *v1;
int v2;
NTSTATUS v3;
PCALLBACK_OBJECT CallbackObject;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int128 PortInformation;
_UNICODE_STRING DestinationString;
_ALPC_PORT_ATTRIBUTES PortAttributes;
*(&ObjectAttributes.Length + 1) = 0;
memset(&ObjectAttributes.Attributes + 1, 0, 20);
v0 = 0i64;
PopAlpcMonitorServerPort = 0i64;
v1 = 0i64;
PopAlpcMonitorClientPort = 0i64;
PortInformation = 0i64;
CallbackObject = 0i64;
DestinationString = 0i64;
RtlInitUnicodeString(&DestinationString, L"\\PowerMonitorPort");
memset(&PortAttributes, 0i64, sizeof(PortAttributes));
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
PortAttributes.Flags = 0x100000;
PortAttributes.MaxMessageLength = 256i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 512;
v2 = ZwAlpcCreatePort((VOID **)&PopAlpcMonitorServerPort, &ObjectAttributes, &PortAttributes);
if( v2 >= 0 )
{
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = 0i64;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 512;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v3 = ExCreateCallback(&CallbackObject, &ObjectAttributes, 1u, 1u);
v0 = CallbackObject;
v2 = v3;
if( v3 >= 0 )
{
v1 = ExRegisterCallback(CallbackObject, PopMonitorAlpcCallback, 0i64);
if( !v1 )
goto LABEL_6;
*(_QWORD *)&PortInformation = v0;
*((_QWORD *)&PortInformation + 1) = PopAlpcMonitorServerPort;
v2 = ZwAlpcSetInformation(
(VOID *)PopAlpcMonitorServerPort,
AlpcRegisterCallbackInformation,
&PortInformation,
0x10ui64);
ObfDereferenceObjectWithTag(v0, 0x746C6644ui64);
if( v2 >= 0 )
{
PopMonitorProcessLoop();
v2 = 0;
LABEL_6:
if( v2 >= 0 )
return v2;
}
}
}
if( PopAlpcMonitorServerPort )
ZwClose(PopAlpcMonitorServerPort);
if( v1 )
ExUnregisterCallback(v1);
if( v0 )
ObfDereferenceObjectWithTag(v0, 0x746C6644ui64);
return v2;
}Referenced by:
PoInitSystem