IoRegisterShutdownNotification

NTSTATUS __stdcall IoRegisterShutdownNotification(_DEVICE_OBJECT *DeviceObject){
  _QWORD *PoolWithTag; 
  _QWORD *v3; 
  INT64 v4; 
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x18ui64, 0x68536F49ui64);
  v3 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  PoolWithTag[2] = DeviceObject;
  ObfReferenceObject(DeviceObject);
  IopInterlockedInsertHeadList(&IopNotifyShutdownQueueHead, v3);
  *((_DWORD *)DeviceObject + 12) |= 0x800u;
  IopLogAuditIoRegisterNotificationEvent(
    (EVENT_DESCRIPTOR *)&KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION,
    DeviceObject,
    v4);
  return 0;
}

Referenced by: