EtwInitializeSiloState

NTSTATUS __stdcall EtwInitializeSiloState(_EJOB *ServerSilo){
  VOID *PoolWithTag; 
  NTSTATUS v3; 
  INT64 v4; 
  INT64 v5; 
  WCHAR v6; 
  unsigned int MaximumProcessorCount; 
  VOID *v8; 
  __int64 v9; 
  unsigned __int64 v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  _WORD *v14; 
  _QWORD *v15; 
  __int64 v16; 
  _QWORD *v17; 
  __int64 v18; 
  __int64 v19; 
  char *v20; 
  __int64 v21; 
  _EJOB *v22; 
  UINT8 IsHostSilo; 
  _EJOB *v24; 
  _ETHREAD *CurrentThread; 
  INT64 v26; 
  unsigned int i; 
  __int64 v29; 
  void *v30; 
  void *v31; 
  void *v32; 
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNxCacheAligned, 0x1220ui64, 0x61777445ui64);
  v3 = 0;
  v4 = (INT64)PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  memset((INT64)PoolWithTag + 8, 0i64);
  *(_QWORD *)v4 = ServerSilo;
  *(_QWORD *)(v4 + 8) = PsGetServerSiloGlobals((__int64)ServerSilo);
  EtwpReadPerSiloConfigParameters(v4, v5, v6);
  MaximumProcessorCount = KeQueryMaximumProcessorCountEx(0xFFFFu);
  v8 = ExAllocatePoolWithTag(
         NonPagedPoolNxCacheAligned,
         MaximumProcessorCount * (24 * *(_DWORD *)(v4 + 16) + 64),
         0x61777445ui64);
  *(_QWORD *)(v4 + 4136) = v8;
  if( !v8 )
    goto LABEL_29;
  memset((INT64)v8, 0i64);
  v9 = MaximumProcessorCount;
  v10 = *(_QWORD *)(v4 + 4136) + ((unsigned __int64)MaximumProcessorCount << 6);
  if( MaximumProcessorCount )
  {
    v11 = 0i64;
    do
    {
      *(_QWORD *)(v11 + *(_QWORD *)(v4 + 4136)) = v10;
      v11 += 64i64;
      v12 = v10 + 8i64 * *(unsigned int *)(v4 + 16);
      *(_QWORD *)(v11 + *(_QWORD *)(v4 + 4136) - 56) = v12;
      v13 = v12 + 8i64 * *(unsigned int *)(v4 + 16);
      *(_QWORD *)(v11 + *(_QWORD *)(v4 + 4136) - 48) = v13;
      v10 = v13 + 8i64 * *(unsigned int *)(v4 + 16);
      --v9;
    }
    while( v9 );
  }
  v14 = (_WORD *)(v4 + 4048);
  *(_WORD *)(v4 + 4048) = 3;
  v15 = (_QWORD *)(v4 + 464);
  v16 = 64i64;
  do
  {
    v15[6] = 0i64;
    v17 = v15;
    v18 = 3i64;
    do
    {
      v17[1] = v17;
      *v17 = v17;
      v17 += 2;
      --v18;
    }
    while( v18 );
    v15 += 7;
    --v16;
  }
  while( v16 );
  v19 = (unsigned int)(8 * *(_DWORD *)(v4 + 16));
  v20 = (char *)ExAllocatePoolWithTag(
                  NonPagedPoolNxCacheAligned,
                  (unsigned int)(16 * *(_DWORD *)(v4 + 16)),
                  0x61777445ui64);
  *(_QWORD *)(v4 + 448) = v20;
  if( !v20 )
  {
LABEL_29:
    v30 = *(void **)(v4 + 4136);
    if( v30 )
      ExFreePoolWithTag(v30, 0x61777445u);
    v31 = *(void **)(v4 + 448);
    if( v31 )
      ExFreePoolWithTag(v31, 0x61777445u);
    v32 = *(void **)(v4 + 4192);
    if( v32 )
      ExFreePoolWithTag(v32, 0x61777445u);
    ExFreePoolWithTag((PVOID)v4, 0x61777445u);
    return -1073741801;
  }
  *(_QWORD *)(v4 + 456) = &v20[v19];
  memset((INT64)v20, 0i64);
  v21 = 0i64;
  if( *(_DWORD *)(v4 + 16) )
  {
    while( 1 )
    {
      *(_QWORD *)(*(_QWORD *)(v4 + 456) + 8 * v21) = 1i64;
      *(_QWORD *)(*(_QWORD *)(v4 + 448) + 8 * v21) = ExAllocateCacheAwareRundownProtection(NonPagedPoolNx, 0x63777445u);
      if( !*(_QWORD *)(*(_QWORD *)(v4 + 448) + 8 * v21) )
        break;
      v21 = (unsigned int)(v21 + 1);
      if( (unsigned int)v21 >= *(_DWORD *)(v4 + 16) )
        goto LABEL_14;
    }
    if( (_DWORD)v21 )
    {
      v29 = 0i64;
      do
      {
        ExFreeCacheAwareRundownProtection(*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v4 + 448) + v29));
        v29 += 8i64;
        --v21;
      }
      while( v21 );
    }
    goto LABEL_29;
  }
LABEL_14:
  *(_QWORD *)(v4 + 416) = v4;
  *(_QWORD *)(v4 + 432) = 0i64;
  *(_OWORD *)(v4 + 64) = SecurityProviderGuid;
  KeInitializeMutex((_KMUTANT *)(v4 + 4584), 0i64);
  PsGetServerSiloGlobals((__int64)ServerSilo)[108] = v4;
  IsHostSilo = PsIsHostSilo(v22);
  if( IsHostSilo )
  {
    qword_140C10DC8 = *(_QWORD *)(v4 + 456);
    EtwpHostSiloState = v4;
    qword_140C10DD0 = v4;
    ExSubscribeWnfStateChange(
      (struct _EX_RUNDOWN_REF **)(v4 + 4144),
      (INT64 *)&WNF_CONT_RESTORE_FROM_SNAPSHOT_COMPLETE,
      1i64,
      0i64,
      (INT64)EtwpContainerResumeWnfCallback,
      0i64);
  }
  v24 = PsAttachSiloToCurrentThread(ServerSilo);
  EtwpQueryPartitionRegistryInformation(
    (_GUID *)(v4 + 4152),
    (PVOID *)(v4 + 4192),
    (_WORD *)(v4 + 4200),
    (_DWORD *)(v4 + 4204),
    v4 + 4184,
    v4 + 4168);
  if( IsHostSilo )
    qword_140D577C8 = KeQueryPerformanceCounter(0i64).QuadPart;
  EtwpInitializeAutoLoggers();
  if( IsHostSilo )
    qword_140D577D0 = KeQueryPerformanceCounter(0i64).QuadPart;
  PsDetachSiloFromCurrentThread(v24);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx(v4 + 432, 0i64);
  v26 = v4 + 156;
  *(_QWORD *)(v4 + 440) = KeGetCurrentThread();
  for( i = 0; i < 8; ++i )
  {
    if( *v14 )
    {
      *(_WORD *)(v26 + 2) = *v14;
      *(_DWORD *)(v26 - 4) = 1;
      *(_BYTE *)v26 = -1;
      *(_QWORD *)(v26 + 12) = -1i64;
      *(_QWORD *)(v26 + 20) = 0i64;
      *(_DWORD *)(v26 + 4) = 64;
      *(_BYTE *)(v4 + 4064) |= 1 << i;
    }
    ++v14;
    v26 += 32i64;
  }
  *(_QWORD *)(v4 + 440) = 0i64;
  ExReleasePushLockEx(v4 + 432, 0i64);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  *(_QWORD *)(v4 + 4096) = 0i64;
  *(_QWORD *)(v4 + 4080) = 0i64;
  *(_QWORD *)(v4 + 4088) = 0i64;
  return v3;
}

Referenced by: