ExpWorkerFactoryInitialization
INT64 __fastcall ExpWorkerFactoryInitialization(){
int v0;
int ObjectType;
INT64 result;
int v4;
__int128 v5;
int v6;
int v7;
int v8;
CHAR(__fastcall *v9)(__int64, void *, __int64, __int64);
VOID(__stdcall *v10)(PVOID);
void *ThreadHandle;
v0 = ExpWorkerFactoryThreadCreationTimeoutInSeconds;
ThreadHandle = 0i64;
if( ExpWorkerFactoryThreadCreationTimeoutInSeconds )
{
if( (unsigned int)ExpWorkerFactoryThreadCreationTimeoutInSeconds > 0x258 )
{
v0 = 600;
ExpWorkerFactoryThreadCreationTimeoutInSeconds = 600;
}
}
else
{
v0 = 1;
ExpWorkerFactoryThreadCreationTimeoutInSeconds = 1;
}
if( ExpWorkerFactoryThreadIdleTimeoutInSeconds )
{
if( (unsigned int)ExpWorkerFactoryThreadIdleTimeoutInSeconds > 0x258 )
ExpWorkerFactoryThreadIdleTimeoutInSeconds = 600;
}
else
{
ExpWorkerFactoryThreadIdleTimeoutInSeconds = 1;
}
ExpWorkerFactoryDeferredMediumTimeout = -1200000i64;
ExpWorkerFactoryDeferredLongTimeout = -10000000i64 * v0;
ExpWorkerFactoryDeferredShortTimeout.QuadPart = -300000i64;
if( ((unsigned __int8)ExpWorkerFactoryThreadCreationList & 0xF) != 0 )
RtlRaiseStatus(-2147483646);
*(_OWORD *)ExpWorkerFactoryThreadCreationList = 0i64;
KeInitializeQueue(&ExpWorkerFactoryManagerQueue, 0i64);
ExpWorkerFactoryThreadCreationTimer = 9i64;
qword_140C16630 = (__int64)&qword_140C16628;
qword_140C16628 = (__int64)&qword_140C16628;
qword_140C16638 = 0i64;
dword_140C1665C = 0;
word_140C16658 = 0;
KeRegisterObjectNotification(
&ExpWorkerFactoryThreadCreationTimer,
&ExpWorkerFactoryManagerQueue,
&ExpWorkerFactoryThreadCreationBlock);
ExpWorkerFactoryThreadCreationState = 0;
memset((INT64)&result, 0i64);
LOWORD(result) = 120;
v9 = ExpCloseWorkerFactory;
v4 = 256;
v10 = ExpDeleteWorkerFactory;
v7 = 512;
v8 = 576;
v5 = ExpWorkerFactoryMapping;
v6 = 983295;
ObjectType = ObCreateObjectType(
(const UNICODE_STRING *)&qword_140A97EE0,
(__int64)&result,
0i64,
(__int64)&ExpWorkerFactoryObjectType);
if( ObjectType >= 0 )
{
ObjectType = PsCreateSystemThread(&ThreadHandle, 0x1FFFFFu, 0i64, 0i64, 0i64, ExpWorkerFactoryManagerThread, 0i64);
if( ObjectType >= 0 )
ZwClose(ThreadHandle);
}
return(unsigned int)ObjectType;
}Referenced by:
ExpInitSystemPhase1