MiCreatePartitionNamespace

NTSTATUS __stdcall MiCreatePartitionNamespace(){
  __int64 v0; 
  __int64 v1; 
  int KernelObjectsSD; 
  void *v3; 
  UINT64 Flags; 
  UINT64 Flagsa; 
  _UNICODE_STRING DestinationString; 
  __int128 SecurityDescriptor[2]; 
  __int64 v9; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v1 = v0;
  DestinationString = 0i64;
  v9 = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  RtlInitUnicodeString(&DestinationString, 0i64);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.SecurityDescriptor = (void *)SePublicDefaultUnrestrictedSd;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  LODWORD(Flags) = 2;
  KernelObjectsSD = ZwCreateDirectoryObjectEx((VOID **)(v1 + 232), 0xF000Fui64, &ObjectAttributes, 0i64, Flags);
  if( KernelObjectsSD >= 0 )
  {
    KernelObjectsSD = ObCreateKernelObjectsSD(SecurityDescriptor);
    if( KernelObjectsSD >= 0 )
    {
      v3 = *(void **)(v1 + 232);
      ObjectAttributes.SecurityQualityOfService = 0i64;
      LODWORD(Flagsa) = 0;
      ObjectAttributes.RootDirectory = v3;
      ObjectAttributes.Length = 48;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)&MiKernelObjectsDirectoryName;
      ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
      ObjectAttributes.Attributes = 576;
      KernelObjectsSD = ZwCreateDirectoryObjectEx((VOID **)(v1 + 240), 0xF000Fui64, &ObjectAttributes, 0i64, Flagsa);
    }
  }
  ObCleanupSecurityDescriptor(SecurityDescriptor);
  return KernelObjectsSD;
}

Referenced by: