ObCreateObjectEx

__int64 __fastcall ObCreateObjectEx(
        char a1,
        _DWORD *a2,
        __int64 a3,
        char a4,
        __int64 a5,
        int a6,
        int a7,
        int a8,
        _QWORD *a9,
        _BYTE *a10){
  struct _KPRCB *CurrentPrcb; 
  __int64 v15; 
  _OBJECT_CREATE_INFORMATION *ObjectCreateInfo; 
  int v17; 
  int v18; 
  int v19; 
  int v20; 
  __int64 v21; 
  __int64 v23; 
  __int64 v24; 
  __int64(__fastcall *v25)(__int64, __int64, __int64); 
  __int64 v26; 
  __int64 v27; 
  void *SecurityDescriptor; 
  struct _KPRCB *v29; 
  __int64 v30; 
  struct _KPRCB *v31; 
  __int64 v32; 
  INT64 UseLookaside; 
  INT64 v34; 
  _BYTE *v35; 
  INT64 v36; 
  _UNICODE_STRING CapturedObjectName; 
  CurrentPrcb = KeGetCurrentPrcb();
  a5 = 0i64;
  v15 = *((_QWORD *)CurrentPrcb + 264);
  CapturedObjectName = 0i64;
  ++*(_DWORD *)(v15 + 20);
  ObjectCreateInfo = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v15);
  if( !ObjectCreateInfo )
  {
    ++*(_DWORD *)(v15 + 24);
    v23 = *((_QWORD *)CurrentPrcb + 265);
    ++*(_DWORD *)(v23 + 20);
    ObjectCreateInfo = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v23);
    if( !ObjectCreateInfo )
    {
      v24 = *(unsigned int *)(v23 + 44);
      v25 = *(__int64(__fastcall **)(__int64, __int64, __int64))(v23 + 48);
      v26 = *(unsigned int *)(v23 + 40);
      v27 = *(unsigned int *)(v23 + 36);
      ++*(_DWORD *)(v23 + 24);
      ObjectCreateInfo = (_OBJECT_CREATE_INFORMATION *)v25(v27, v24, v26);
      if( !ObjectCreateInfo )
        return 3221225626i64;
    }
  }
  LODWORD(UseLookaside) = 0;
  ObjectCreateInfo->Attributes = *((_DWORD *)CurrentPrcb + 9);
  v17 = ObpCaptureObjectCreateInformation(
          (unsigned __int8)a1,
          (unsigned __int8)a4,
          (_OBJECT_ATTRIBUTES *)a3,
          &CapturedObjectName,
          ObjectCreateInfo,
          UseLookaside,
          v34,
          v36);
  if( v17 >= 0 )
  {
    if( (ObjectCreateInfo->Attributes & a2[18]) != 0 )
    {
      v20 = -1073741811;
    }
    else if( (ObjectCreateInfo->Attributes & 0x10) == 0
           || SeSinglePrivilegeCheck(*(_QWORD *)&SeCreatePermanentPrivilege, a1) )
    {
      v18 = a7;
      if( !a7 )
        v18 = a2[26];
      v19 = a8;
      if( !a8 )
        v19 = a2[27];
      ObjectCreateInfo->PagedPoolCharge = v18;
      v35 = a10;
      ObjectCreateInfo->NonPagedPoolCharge = v19;
      v20 = ObpAllocateObject((int *)ObjectCreateInfo, a4, (__int64)a2, &CapturedObjectName, a6, &a5, v35);
      if( v20 >= 0 )
      {
        v21 = a5;
        if( ObpTraceFlags )
        {
          ObpRegisterObject((_OBJECT_HEADER *)a5);
          ObpPushStackInfo(v21, 1, 1i64, 1953261124i64);
        }
        *a9 = v21 + 48;
        return(unsigned int)v20;
      }
    }
    else
    {
      v20 = -1073741727;
    }
    if( CapturedObjectName.Buffer )
      ObpFreeObjectNameBuffer(&CapturedObjectName);
    SecurityDescriptor = ObjectCreateInfo->SecurityDescriptor;
    if( SecurityDescriptor )
    {
      SeReleaseSecurityDescriptor(SecurityDescriptor, ObjectCreateInfo->ProbeMode, 1u);
      ObjectCreateInfo->SecurityDescriptor = 0i64;
    }
    v29 = KeGetCurrentPrcb();
    v30 = *((_QWORD *)v29 + 264);
    ++*(_DWORD *)(v30 + 28);
    if( *(_WORD *)v30 < *(_WORD *)(v30 + 16)
      || (++*(_DWORD *)(v30 + 32),
          v30 = *((_QWORD *)v29 + 265),
          ++*(_DWORD *)(v30 + 28),
          *(_WORD *)v30 < *(_WORD *)(v30 + 16)) )
    {
      RtlpInterlockedPushEntrySList((PSLIST_HEADER)v30, (PSLIST_ENTRY)ObjectCreateInfo);
    }
    else
    {
      ++*(_DWORD *)(v30 + 32);
      (*(void(__fastcall **)(_OBJECT_CREATE_INFORMATION *))(v30 + 56))(ObjectCreateInfo);
    }
    return(unsigned int)v20;
  }
  v31 = KeGetCurrentPrcb();
  v32 = *((_QWORD *)v31 + 264);
  ++*(_DWORD *)(v32 + 28);
  if( *(_WORD *)v32 < *(_WORD *)(v32 + 16)
    || (++*(_DWORD *)(v32 + 32),
        v32 = *((_QWORD *)v31 + 265),
        ++*(_DWORD *)(v32 + 28),
        *(_WORD *)v32 < *(_WORD *)(v32 + 16)) )
  {
    RtlpInterlockedPushEntrySList((PSLIST_HEADER)v32, (PSLIST_ENTRY)ObjectCreateInfo);
  }
  else
  {
    ++*(_DWORD *)(v32 + 32);
    (*(void(__fastcall **)(_OBJECT_CREATE_INFORMATION *))(v32 + 56))(ObjectCreateInfo);
  }
  return(unsigned int)v17;
}

Referenced by: