CmFcManagerStartRuntimePhase
INT64 __stdcall CmFcManagerStartRuntimePhase(){
__int64 *v0;
__int64 v1;
__int64 v2;
__int64 v3;
int SectionFromBuffer;
_ETHREAD *CurrentThread;
INT64 v6;
__int64 *v7;
__int64 v8;
INT64 v9;
VOID *v10;
VOID *v11;
unsigned int v12;
unsigned int v13;
__int64 v14;
__int64 v15;
__int64 v16;
unsigned int i;
__int64 v18;
_OWORD *v19;
_OWORD *PoolWithTag;
_OWORD *v21;
__int64 v22;
__int128 v23;
bool IsStateSeparationEnabled;
WCHAR v25;
const WCHAR *v26;
__int64 *v27;
__int64 v28;
__int64 *v29;
INT64 a2;
_QWORD DestinationString[3];
__int64 result[10];
__int64 v34[3];
INT64 a1[3];
v0 = v34;
a2 = 0i64;
*(_OWORD *)&DestinationString[1] = 0i64;
v1 = 3i64;
do
{
CmFcpInitializeSectionState((INT64)v0);
v0 = (__int64 *)(v2 + 24);
}
while( v3 != 1 );
DestinationString[0] = 0i64;
memset((INT64)result, 0i64);
byte_140C47FD2 = 1;
SectionFromBuffer = SeConvertStringSecurityDescriptorToSecurityDescriptor((PVOID *)L"O:SYG:SYD:(A;;GR;;;SY)(A;;GR;;;BA)("
"A;;GR;;;IU)(A;;GR;;;AU)(A;;GR;;;AC"
")(A;;GR;;;S-1-5-32-1045063015-4238"
"99465-3012769174-65638258-18658744"
"12-2349348127-763856749-1075684855"
")(A;;GR;;;S-1-15-3-1024-1045063015"
"-423899465-3012769174-65638258-186"
"5874412-2349348127-763856749-10756"
"84855)(A;;GR;;;S-1-5-80-2970612574"
"-78537857-698502321-558674196-1451"
"644582)(A;;GR;;;S-1-15-3-1024-1502"
"825166-1963708345-2616377461-25628"
"97074-4192028372-3968301570-199762"
"8692-1435953622)");
if( SectionFromBuffer >= 0 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
CmpVolumeManagerLockContextListExclusive((UINT64)&stru_140C47E90);
RtlpFcBufferManagerReferenceBuffers((INT64)&qword_140C47EF0, (INT64)&a2, DestinationString);
v6 = a2;
v7 = v34;
v8 = 3i64;
do
{
*v7 = v6;
v7 += 3;
--v8;
}
while( v8 );
v9 = DestinationString[0];
v10 = *(VOID **)(DestinationString[0] + 8i64);
if( v10 )
{
SectionFromBuffer = CmFcpManagerCreateSectionFromBuffer(v10, *(_QWORD *)(DestinationString[0] + 16i64), v6);
if( SectionFromBuffer < 0 )
goto LABEL_30;
CmFcpCopySectionState((INT64)a1, (INT64)v34);
v6 = a2;
}
v11 = *(VOID **)(v9 + 56);
if( !v11
|| (SectionFromBuffer = CmFcpManagerCreateSectionFromBuffer(v11, *(_QWORD *)(v9 + 64), v6), SectionFromBuffer >= 0) )
{
RtlpFcBufferManagerDereferenceBuffers(&qword_140C47EF0, v9);
v9 = 0i64;
v12 = 0;
while( 1 )
{
v13 = RtlpFcSectionTypeToBufferType(v12);
SectionFromBuffer = CmFcpMapSection(&v34[3 * v12], &result[3 * v13]);
if( SectionFromBuffer < 0 )
goto LABEL_33;
if( ++v12 >= 3 )
{
CmpVolumeManagerLockContextListExclusive((UINT64)&RunOnce);
v14 = 0i64;
do
{
CmFcpSwapSectionState((INT64 *)((char *)&CmFcSystemManager + v14 + 40), (__int64 *)((char *)v34 + v14));
v14 = v15 + 24;
}
while( v16 != 1 );
RtlpFcBufferManagerUpdateBuffers(&qword_140C47EF0, a2, (INT64)result);
memset((INT64)result, 0i64);
RtlpFcWriteHighLowHigh(0xFFFFF78000000710ui64, a2);
CmSiRWLockReleaseExclusive(&RunOnce);
SectionFromBuffer = ZwUpdateWnfStateData();
if( SectionFromBuffer >= 0 )
{
for( i = 0; i < 2; ++i )
{
v18 = ((unsigned __int8)RtlGetSwapReferenceIndex(&rcx0) - 1) & 1;
v19 = (_OWORD *)*((_QWORD *)&CmFcSystemManager + v18 + 43);
PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x310ui64, 0x63466D43ui64);
v21 = PoolWithTag;
if( !PoolWithTag )
goto LABEL_32;
if( v19 )
{
v22 = 6i64;
do
{
*PoolWithTag = *v19;
PoolWithTag[1] = v19[1];
PoolWithTag[2] = v19[2];
PoolWithTag[3] = v19[3];
PoolWithTag[4] = v19[4];
PoolWithTag[5] = v19[5];
PoolWithTag[6] = v19[6];
PoolWithTag += 8;
v23 = v19[7];
v19 += 8;
*(PoolWithTag - 1) = v23;
--v22;
}
while( v22 );
*PoolWithTag = *v19;
}
else
{
RtlpFcInitializeDelayedUsageReportBuffer((INT64)PoolWithTag);
}
*((_QWORD *)&CmFcSystemManager + v18 + 43) = v21;
RtlUpdateSwapReference((INT64)&rcx0, v18);
}
qword_140C48068 = (__int64)ExAllocateTimer(
CmFcpManagerRetryUsageNotificationsTimerRoutine,
&CmFcSystemManager,
8u);
if( !qword_140C48068 )
{
LABEL_32:
SectionFromBuffer = -1073741670;
goto LABEL_33;
}
IsStateSeparationEnabled = RtlIsStateSeparationEnabled();
v26 = L"\\REGISTRY\\MACHINE\\OSDATA";
if( !IsStateSeparationEnabled )
v26 = L"\\REGISTRY\\MACHINE\\SOFTWARE";
RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], v26, v25);
SectionFromBuffer = CmRegisterMachineHiveLoadedNotification(
(WCHAR *)CmFcpManagerSoftwareHiveReady,
&CmFcSystemManager,
(const UNICODE_STRING *)&DestinationString[1],
&qword_140C47FA8);
if( SectionFromBuffer >= 0 )
{
SectionFromBuffer = 0;
break;
}
}
goto LABEL_33;
}
}
}
LABEL_30:
if( v9 )
RtlpFcBufferManagerDereferenceBuffers(&qword_140C47EF0, v9);
LABEL_33:
CmSiRWLockReleaseExclusive(&stru_140C47E90);
KeLeaveCriticalRegion();
}
v27 = result;
v28 = 3i64;
do
{
CmFcpUnmapSection((INT64)v27);
v27 += 3;
--v28;
}
while( v28 );
v29 = v34;
do
{
CmFcpCleanupSectionState((INT64)v29);
v29 += 3;
--v1;
}
while( v1 );
return(unsigned int)SectionFromBuffer;
}Referenced by:
CmFcInitSystem2