PopDirectedDripsInitializePhase3

INT64 __fastcall PopDirectedDripsInitializePhase3(INT64 a1, INT64 a2, WCHAR a3){
  INT64 v3; 
  EVENT_DESCRIPTOR *v4; 
  NTSTATUS v5; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *ThreadHandle; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  ThreadHandle = 0i64;
  PopDirectedDripsDiagInitialize(3i64, a2, a3);
  PopDirectedDripsQueryEnabledMitigations();
  if( (dword_140C24A10 & 3) != 0 )
  {
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = 0i64;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 512;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v5 = PsCreateSystemThread(
           &ThreadHandle,
           0,
           &ObjectAttributes,
           0i64,
           0i64,
           PopDirectedDripsWorkerRoutine,
           &PopDirectedDripsState);
    if( v5 >= 0 )
    {
      v5 = ObReferenceObjectByHandleWithTag(
             ThreadHandle,
             0x1FFFFFu,
             (POBJECT_TYPE)PsThreadType,
             0,
             0x67446F50u,
             &qword_140C249F0,
             0i64);
      ZwClose(ThreadHandle);
      if( v5 >= 0 )
      {
        if( (unsigned int)PopDirectedDripsDfxEnforcementPolicy >= 3 )
          PopDirectedDripsDfxEnforcementPolicy = 1;
        LODWORD(PopDirectedDripsState) = PopDirectedDripsState | 1;
        v5 = 0;
      }
    }
  }
  else
  {
    v5 = -1073741637;
  }
  PopDiagTraceDirectedDripsInitialization((unsigned int)v5, v3, v4);
  return(unsigned int)v5;
}

Referenced by: