PopCreatePowerThread

NTSTATUS __fastcall PopCreatePowerThread(KSTART_ROUTINE *a1, void *a2){
  NTSTATUS result; 
  NTSTATUS v3; 
  UINT64 Tag; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *ThreadHandle; 
  PVOID Object; 

  memset(&ObjectAttributes.Length + 1, 0, 20);
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  Object = 0i64;
  ThreadHandle = 0i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  result = PsCreateSystemThread(&ThreadHandle, 0x1FFFFFu, &ObjectAttributes, 0, 0i64, a1, a2);
  if( result >= 0 )
  {
    LODWORD(Tag) = 1917415248;
    v3 = ObReferenceObjectByHandleWithTag(
           ThreadHandle,
           0x1FFFFFui64,
           (_OBJECT_TYPE *)PsThreadType,
           0,
           Tag,
           &Object,
           0i64);
    ZwClose((_HANDLE)ThreadHandle);
    if( v3 >= 0 )
    {
      KeSetActualBasePriorityThread((_KTHREAD *)Object, 13i64);
      ObfDereferenceObjectWithTag(Object, 0x72496F50ui64);
    }
    return 0;
  }
  return result;
}

Referenced by: