PspCreateActivityReference

NTSTATUS __stdcall PspCreateActivityReference(PVOID Object, INT64 a2){
  UINT64 v2; 
  NTSTATUS result; 
  _QWORD *v6; 
  VOID *v7; 
  VOID *v8; 
  UINT64 ObjectBodySize; 
  PVOID *Handle; 
  UINT64 NonPagedPoolCharge; 
  _OBJECT_ATTRIBUTES v12; 
  UINT64 Tag; 

  memset(&v12.Length + 1, 0, 20);
  memset(&v12.Attributes + 1, 0, 20);
  LOBYTE(v2) = KeGetCurrentThread()->PreviousMode;
  Tag = 0i64;
  v12.Length = 48;
  LODWORD(NonPagedPoolCharge) = 8;
  LODWORD(Handle) = 0;
  v12.Attributes = 32;
  LODWORD(ObjectBodySize) = 8;
  result = ObCreateObjectEx(
             0i64,
             PspActivityReferenceObjectType,
             &v12,
             v2,
             v7,
             ObjectBodySize,
             (UINT64)Handle,
             NonPagedPoolCharge,
             (VOID **)&Tag,
             0i64);
  if( result >= 0 )
  {
    v6 = (_QWORD *)Tag;
    LODWORD(v8) = 0;
    *v6 = PsChargeProcessWakeCounter(Object, 0i64, PsWakeReasonActivityReference, Tag);
    return ObInsertObjectEx(v6, 0i64, 0xF0000ui64, 0i64, (UINT64)v8, 0i64, (VOID **)a2);
  }
  return result;
}

Referenced by: