NtCreatePartition

NTSTATUS __fastcall NtCreatePartition(
        VOID **ParentPartitionHandle,
        VOID **PartitionHandle,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes){
  unsigned int v5; 
  char PreviousMode; 
  __int64 v9; 
  int Partition; 
  INT64 a7; 
  UINT64 a4; 
  __int64 a6[3]; 

  v5 = DesiredAccess;
  a6[0] = 0i64;
  a7 = 0i64;
  a4 = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v9 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)PartitionHandle < 0x7FFFFFFF0000i64 )
      v9 = (__int64)PartitionHandle;
    *(_QWORD *)v9 = *(_QWORD *)v9;
  }
  if( SeSinglePrivilegeCheck(*(_QWORD *)&SeLockMemoryPrivilege, PreviousMode) )
  {
    if( !ParentPartitionHandle
      || (Partition = PsReferencePartitionByHandle(ParentPartitionHandle, 2ui64, PreviousMode, 0x70437350u, &a4),
          Partition >= 0) )
    {
      Partition = PspAllocatePartition(ObjectAttributes, v5, PreviousMode, a4, 0, (INT64)a6, (INT64)&a7);
      if( Partition >= 0 )
      {
        PsDereferencePartition(a6[0]);
        *PartitionHandle = (VOID *)a7;
      }
    }
  }
  else
  {
    Partition = -1073741727;
  }
  if( a4 )
    PsDereferencePartition(a4);
  return Partition;
}

Referenced by: