FsRtlInitSystem
INT64 __stdcall FsRtlInitSystem(){
__int64 v0;
__int64 v1;
INT64 result;
VOID *v3;
struct _UNICODE_STRING ValueName;
UINT64 Value;
LODWORD(Value) = 0;
*(_DWORD *)(&ValueName.MaximumLength + 1) = 0;
FsRtlPagingIoResources = (__int64)ExAllocatePoolWithTag((_POOL_TYPE)528, 0x680ui64, 0x74725346ui64);
v0 = 16i64;
v1 = 0i64;
do
{
ExInitializeResourceLite((PERESOURCE)(v1 + FsRtlPagingIoResources));
v1 += 104i64;
--v0;
}
while( v0 );
FsRtlInitializeTunnels();
FsRtlInitializeFileLocks();
FsRtlInitializeLargeMcbs();
ExInitializePagedLookasideList((PPAGED_LOOKASIDE_LIST)&FsRtlEcpListLookaside, 0i64, 0i64, 0, 0x18ui64, 0x6C655346u, 0);
FsRtlpUncSemaphore.Header.Type = 5;
FsRtlpUncSemaphore.Header.WaitListHead.Blink = &FsRtlpUncSemaphore.Header.WaitListHead;
FsRtlpUncSemaphore.Header.WaitListHead.Flink = &FsRtlpUncSemaphore.Header.WaitListHead;
FsRtlpUncSemaphore.Header.Size = 8;
ValueName.Buffer = L"Win95TruncatedExtensions";
FsRtlpUncSemaphore.Header.SignalState = 1;
FsRtlpUncSemaphore.Limit = 0x7FFFFFFF;
*(_DWORD *)&ValueName.Length = 3276848;
if( FsRtlGetCompatibilityModeValue(&ValueName, &Value) >= 0 && (_DWORD)Value )
FsRtlSafeExtensions = 0;
LODWORD(result) = FsRtlInitializeWorkerThread();
if( (int)result < 0
|| (result = FsFilterInit(), (int)result < 0)
|| (LODWORD(result) = FsRtlInitializeSmssEvent(), (int)result < 0) )
{
LOBYTE(result) = 0;
}
else
{
FsRtlInitializeTieringHeat(v3);
LOBYTE(result) = 1;
}
return result;
}Referenced by:
Phase1InitializationDiscard