IoCreateSystemThread

NTSTATUS __stdcall IoCreateSystemThread(
        PVOID IoObject,
        PHANDLE ThreadHandle,
        UINT32 DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        HANDLE ProcessHandle,
        PCLIENT_ID ClientId,
        PKSTART_ROUTINE StartRoutine,
        PVOID StartContext){
  CHAR *Pool_1; 
  CHAR *v13; 
  int SystemThread; 
  if( (unsigned __int16)(*(_WORD *)IoObject - 3) > 1u )
    KeBugCheckEx(0x148u, 0i64, (ULONG_PTR)StartRoutine, (ULONG_PTR)IoObject, 0i64);
  Pool_1 = IopVerifierExAllocatePool_1(PagedPool, 0x18ui64);
  v13 = Pool_1;
  if( !Pool_1 )
    return -1073741670;
  *(_QWORD *)Pool_1 = IoObject;
  *((_QWORD *)Pool_1 + 1) = StartRoutine;
  *((_QWORD *)Pool_1 + 2) = StartContext;
  ObfReferenceObject(IoObject);
  SystemThread = PsCreateSystemThreadEx(
                   ThreadHandle,
                   DesiredAccess,
                   ObjectAttributes,
                   ProcessHandle,
                   ClientId,
                   IopThreadStart,
                   v13,
                   0i64,
                   0i64);
  if( SystemThread < 0 )
  {
    HalPutDmaAdapter((PADAPTER_OBJECT)IoObject);
    ExFreePoolWithTag(v13, 0);
  }
  return SystemThread;
}

Referenced by: