PopCreatePowerThread

NTSTATUS __fastcall PopCreatePowerThread(KSTART_ROUTINE *a1, void *a2){
  NTSTATUS result; 
  NTSTATUS v3; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *ThreadHandle; 
  PVOID Object; 
  memset(&ObjectAttributes.Length + 1, 0, 20);
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  Object = 0i64;
  ThreadHandle = 0i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  result = PsCreateSystemThread(&ThreadHandle, 0x1FFFFFu, &ObjectAttributes, 0i64, 0i64, a1, a2);
  if( result >= 0 )
  {
    v3 = ObReferenceObjectByHandleWithTag(
           ThreadHandle,
           0x1FFFFFu,
           (POBJECT_TYPE)PsThreadType,
           0,
           0x72496F50u,
           &Object,
           0i64);
    ZwClose(ThreadHandle);
    if( v3 >= 0 )
    {
      KeSetActualBasePriorityThread((__int64)Object, 13);
      ObfDereferenceObjectWithTag(Object, 0x72496F50ui64);
    }
    return 0;
  }
  return result;
}

Referenced by: