ObCreateObject

NTSTATUS __stdcall ObCreateObject(
        INT8 ProbeMode,
        _OBJECT_TYPE *ObjectType,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        INT8 OwnershipMode,
        VOID *ParseContext,
        UINT64 ObjectBodySize,
        UINT64 PagedPoolCharge,
        UINT64 NonPagedPoolCharge,
        VOID **Object){
  VOID *v10; 
  UINT64 v11; 
  UINT64 v12; 
  UINT64 v13; 

  LODWORD(v13) = NonPagedPoolCharge;
  LODWORD(v12) = PagedPoolCharge;
  LODWORD(v11) = ObjectBodySize;
  return ObCreateObjectEx(ProbeMode, ObjectType, ObjectAttributes, OwnershipMode, v10, v11, v12, v13, Object, 0i64);
}

Referenced by: