PpIrpAllocateDeviceUsageNotification

_IRP *__stdcall PpIrpAllocateDeviceUsageNotification(INT64 a1){
  _KEVENT *v1; 
  INT64 v3; 
  _IRP *result; 
  _IO_STACK_LOCATION *CurrentStackLocation; 

  v1 = (_KEVENT *)(a1 + 40);
  KeInitializeEvent(a1 + 40, 0, 0);
  LOBYTE(v3) = *(_BYTE *)(*(_QWORD *)a1 + 76i64);
  result = (_IRP *)IoAllocateIrp(v3, 0);
  if( result )
  {
    result->Tail.OriginalFileObject = *(_FILE_OBJECT **)(a1 + 16);
    result->Tail.Thread = (_ETHREAD *)KeGetCurrentThread();
    result->UserIosb = (_IO_STATUS_BLOCK *)(a1 + 24);
    CurrentStackLocation = result->Tail.CurrentStackLocation;
    result->RequestorMode = 0;
    result->UserEvent = v1;
    result->Flags = 4;
    result->Overlay.UserApcRoutine = 0i64;
    *(_WORD *)&CurrentStackLocation[-1].MajorFunction = 5659;
    CurrentStackLocation[-1].FileObject = *(_FILE_OBJECT **)(a1 + 16);
    result->IoStatus.Status = -1073741637;
    result->AssociatedIrp.MasterIrp = 0i64;
    LOBYTE(CurrentStackLocation[-1].Parameters.SecurityContext) = *(_BYTE *)(a1 + 12);
    CurrentStackLocation[-1].Parameters.Options = *(_DWORD *)(a1 + 8);
  }
  return result;
}

Referenced by: