IoRegisterLastChanceShutdownNotification

NTSTATUS __stdcall IoRegisterLastChanceShutdownNotification(_DEVICE_OBJECT *DeviceObject){
  _QWORD *PoolWithTag; 
  INT64 v3; 
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x18ui64, 0x68536F49ui64);
  if( !PoolWithTag )
    return -1073741670;
  ObfReferenceObject(DeviceObject);
  PoolWithTag[2] = DeviceObject;
  IopInterlockedInsertHeadList(&IopNotifyLastChanceShutdownQueueHead, PoolWithTag);
  *((_DWORD *)DeviceObject + 12) |= 0x800u;
  IopLogAuditIoRegisterNotificationEvent(
    (EVENT_DESCRIPTOR *)&KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION,
    DeviceObject,
    v3);
  return 0;
}

Referenced by: