NtCreateIoCompletion

NTSTATUS __stdcall NtCreateIoCompletion(
        VOID **IoCompletionHandle,
        _ACCESS_MASK DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        UINT64 Count,
        VOID *a5){
  unsigned int v5; 
  VOID **v7; 
  char PreviousMode; 
  int Object; 
  UINT64 v10; 
  _KQUEUE *v11; 
  VOID *v13; 
  VOID *v14; 
  UINT64 ObjectBodySize; 
  PVOID *Handle; 
  UINT64 v17; 
  PVOID v18; 
  _KQUEUE *Queue; 

  v5 = Count;
  v7 = IoCompletionHandle;
  v18 = 0i64;
  Queue = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    IoCompletionHandle = (VOID **)0x7FFFFFFF0000i64;
    if( (unsigned __int64)v7 < 0x7FFFFFFF0000i64 )
      IoCompletionHandle = v7;
    *IoCompletionHandle = *IoCompletionHandle;
  }
  LODWORD(v17) = 0;
  LODWORD(Handle) = 0;
  LODWORD(ObjectBodySize) = 80;
  LOBYTE(Count) = PreviousMode;
  LOBYTE(IoCompletionHandle) = PreviousMode;
  Object = ObCreateObjectEx(
             (UINT64)IoCompletionHandle,
             IoCompletionObjectType,
             ObjectAttributes,
             Count,
             v13,
             ObjectBodySize,
             (UINT64)Handle,
             v17,
             (VOID **)&Queue,
             0i64);
  if( Object >= 0 )
  {
    v10 = v5;
    v11 = Queue;
    KeInitializeQueue(Queue, v10);
    *((_QWORD *)v11 + 8) = 0i64;
    *((_BYTE *)v11 + 72) = 0;
    LODWORD(v14) = 0;
    Object = ObInsertObjectEx(v11, 0i64, (unsigned int)DesiredAccess, 0i64, (UINT64)v14, 0i64, &v18);
    if( Object >= 0 )
      *v7 = v18;
  }
  return Object;
}

Referenced by: