MiCreatePartitionNamespace

INT64 __fastcall MiCreatePartitionNamespace(INT64 a1, INT64 a2, WCHAR a3){
  int KernelObjectsSD; 
  void *v5; 
  UINT64 Flags; 
  UINT64 Flagsa; 
  struct _UNICODE_STRING DestinationString; 
  __int128 SecurityDescriptor[2]; 
  __int64 v11; 
  OBJECT_ATTRIBUTES ObjectAttributes; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DestinationString = 0i64;
  v11 = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  RtlInitUnicodeString(&DestinationString, 0i64, a3);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.SecurityDescriptor = (void *)SePublicDefaultUnrestrictedSd;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  LODWORD(Flags) = 2;
  KernelObjectsSD = ZwCreateDirectoryObjectEx((PVOID *)(a1 + 232), 0xF000Fui64, &ObjectAttributes, 0i64, Flags);
  if( KernelObjectsSD >= 0 )
  {
    KernelObjectsSD = ObCreateKernelObjectsSD(SecurityDescriptor);
    if( KernelObjectsSD >= 0 )
    {
      v5 = *(void **)(a1 + 232);
      ObjectAttributes.SecurityQualityOfService = 0i64;
      LODWORD(Flagsa) = 0;
      ObjectAttributes.RootDirectory = v5;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)&MiKernelObjectsDirectoryName;
      ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
      ObjectAttributes.Attributes = 576;
      KernelObjectsSD = ZwCreateDirectoryObjectEx((PVOID *)(a1 + 240), 0xF000Fui64, &ObjectAttributes, 0i64, Flagsa);
    }
  }
  ObCleanupSecurityDescriptor(SecurityDescriptor);
  return(unsigned int)KernelObjectsSD;
}

Referenced by: