PsCreateSiloContext

NTSTATUS __fastcall PsCreateSiloContext(INT64 a1, UINT64 a2, INT64 a3, INT64 a4, INT64 *ReturnedSiloContext){
  INT64 *v5; 
  int v7; 
  PADAPTER_OBJECT v9; 
  int v10; 
  VOID *v11; 
  INT64 *v12; 
  VOID *v14; 
  UINT64 ObjectBodySize; 
  UINT64 PagedPoolCharge; 
  UINT64 NonPagedPoolCharge; 
  VOID *Object; 
  _OB_EXTENDED_CREATION_INFO ExtendedInfo; 

  v5 = 0i64;
  Object = 0i64;
  v7 = a2;
  if( (_DWORD)a3 == 1 )
  {
    v9 = PsSiloContextPagedType;
  }
  else
  {
    if( (_DWORD)a3 != 512 )
      return -1073741811;
    v9 = PsSiloContextNonPagedType;
  }
  ExtendedInfo.AllowHandleRevocation = 0;
  ExtendedInfo.AllowExtendedUserInfo = 1;
  LODWORD(NonPagedPoolCharge) = 0;
  LODWORD(PagedPoolCharge) = 0;
  LODWORD(ObjectBodySize) = v7;
  v10 = ObCreateObjectEx(
          0i64,
          (_OBJECT_TYPE *)v9,
          0i64,
          0i64,
          v14,
          ObjectBodySize,
          PagedPoolCharge,
          NonPagedPoolCharge,
          &Object,
          &ExtendedInfo);
  if( v10 >= 0 )
  {
    v11 = Object;
    if( (*((char *)Object - 22) & 0x40) != 0 )
      v5 = (INT64 *)(*(_QWORD *)((char *)Object
                               - *((unsigned __int8 *)&dword_140C25D60 + (*((char *)Object - 22) & 0x7F))
                               - 48)
                   + 32i64);
    v12 = ReturnedSiloContext;
    *v5 = a1;
    v5[1] = a4;
    *v12 = (INT64)v11;
  }
  return v10;
}

Referenced by: