IoCreateDriver

NTSTATUS __stdcall IoCreateDriver(
        PHANDLE EnlistmentHandle,
        ACCESS_MASK DesiredAccess,
        HANDLE RmHandle,
        LPGUID EnlistmentGuid,
        POBJECT_ATTRIBUTES ObjectAttributes){
  _DMA_OPERATIONS *v5; 
  NTSTATUS result; 
  PADAPTER_OBJECT v7; 
  _ETHREAD *CurrentThread; 
  BOOL v9; 
  PVOID *i; 
  _DMA_OPERATIONS *v11; 
  CHAR *Pool_1; 
  CHAR *v13; 
  unsigned __int64 v14; 
  __int128 v15; 
  PADAPTER_OBJECT v16; 
  int inserted; 
  HANDLE v18; 
  NTSTATUS v19; 
  void *v20; 
  CHAR *v21; 
  __int64 v22; 
  EVENT_DESCRIPTOR *v23; 
  PVOID *Object; 
  PVOID *Objecta; 
  void *Src[2]; 
  PADAPTER_OBJECT DmaAdapter; 
  size_t pcchLength; 
  HANDLE Handle; 
  PVOID v30; 
  __int128 v31; 
  int v32[2]; 
  __int64 v33; 
  void **v34; 
  int v35; 
  int v36; 
  __int128 v37; 
  wchar_t pszDest[64]; 
  v32[1] = 0;
  v36 = 0;
  v5 = *(_DMA_OPERATIONS **)&DesiredAccess;
  DmaAdapter = 0i64;
  Handle = 0i64;
  pcchLength = 0i64;
  *(_OWORD *)Src = 0i64;
  v31 = 0i64;
  if( EnlistmentHandle )
  {
    *(_OWORD *)Src = *(_OWORD *)EnlistmentHandle;
    goto LABEL_3;
  }
  _InterlockedExchangeAdd(&IopUniqueDriverObjectNumber, 1u);
  RtlStringCchPrintfW(pszDest, 0x3Cui64, (WCHAR *)L"\\Driver\\%08u");
  result = RtlStringCchLengthW(pszDest, 0x3Cui64, &pcchLength);
  if( result >= 0 )
  {
    if( pcchLength > 0xFFFF )
      return -2147483643;
    LOWORD(Src[0]) = 2 * pcchLength;
    WORD1(Src[0]) = 2 * pcchLength + 2;
    Src[1] = pszDest;
LABEL_3:
    v34 = Src;
    v32[0] = 48;
    v33 = 0i64;
    v35 = 592;
    v37 = 0i64;
    result = ObCreateObjectEx(0, IoDriverObjectType, (__int64)v32, 0, (__int64)Object, 416, 0, 0, &DmaAdapter, 0i64);
    if( result < 0 )
      return result;
    v7 = DmaAdapter;
    memset((INT64)DmaAdapter, 0i64);
    *(_QWORD *)&v7[3].Version = v7 + 21;
    *(_QWORD *)&v7[21].Version = v7;
    *(_DWORD *)&v7->Version = 22020100;
    *(_DWORD *)&v7[1].Version = 4;
    memset64(&v7[7], (unsigned __int64)IopInvalidDeviceRequest, 0x1Cui64);
    v7[5].DmaOperations = v5;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    LOBYTE(v9) = 1;
    ExAcquireResourceSharedLite(&PsLoadedModuleResource, v9);
    for( i = (PVOID *)PsLoadedModuleList; i != &PsLoadedModuleList; i = (PVOID *)*i )
    {
      v11 = (_DMA_OPERATIONS *)i[6];
      if( v5 >= v11 && v5 < (_DMA_OPERATIONS *)((char *)v11 + *((unsigned int *)i + 16)) )
      {
        DmaAdapter[1].DmaOperations = v11;
        break;
      }
    }
    ExReleaseResourceLite(&PsLoadedModuleResource);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    Pool_1 = IopVerifierExAllocatePool_1(PagedPool, LOWORD(Src[0]) + 2i64);
    *((_QWORD *)&v31 + 1) = Pool_1;
    v13 = Pool_1;
    if( Pool_1 )
    {
      LOWORD(v31) = Src[0];
      v14 = LOWORD(Src[0]);
      WORD1(v31) = LOWORD(Src[0]) + 2;
      memmove((UINT8 *)Pool_1, (UINT8 *)Src[1], LOWORD(Src[0]));
      v15 = v31;
      v16 = DmaAdapter;
      *(_WORD *)&v13[2 * (v14 >> 1)] = 0;
      *(_OWORD *)(*(_QWORD *)&v7[3].Version + 24i64) = v15;
      LODWORD(Objecta) = 0;
      inserted = ObInsertObjectEx(v16, 0i64, 1ui64, 0i64, (UINT64)Objecta, 0i64, &Handle);
      if( inserted < 0 )
        return inserted;
      v18 = Handle;
      v30 = 0i64;
      v19 = ObReferenceObjectByHandle(Handle, 0, IoDriverObjectType, 0, &v30, 0i64);
      v20 = v30;
      inserted = v19;
      if( v19 < 0 )
      {
        ZwMakeTemporaryObject(v18);
        ZwClose(v18);
        return inserted;
      }
      ZwClose(v18);
      v21 = IopVerifierExAllocatePool_1(NonPagedPoolNx, WORD1(Src[0]));
      *((_QWORD *)v20 + 8) = v21;
      if( v21 )
      {
        *((_DWORD *)v20 + 14) = Src[0];
        memmove(*((UINT8 **)v20 + 8), (UINT8 *)Src[1], WORD1(Src[0]));
      }
      inserted = ((__int64(__fastcall *)(void *, _QWORD))v5)(v20, 0i64);
      if( inserted >= 0 )
      {
        EtwTiLogDriverObjectLoad((unsigned __int16 *)Src, v22, v23);
        return inserted;
      }
    }
    else
    {
      v20 = DmaAdapter;
      inserted = -1073741670;
    }
    ObMakeTemporaryObject(v20);
    HalPutDmaAdapter((PADAPTER_OBJECT)v20);
    return inserted;
  }
  return result;
}

Referenced by: