ObCreateObjectEx

NTSTATUS __stdcall ObCreateObjectEx(
        UINT64 ProbeMode,
        _OBJECT_TYPE *ObjectType,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        UINT64 OwnershipMode,
        VOID *ParseContext,
        UINT64 ObjectBodySize,
        UINT64 PagedPoolCharge,
        UINT64 NonPagedPoolCharge,
        VOID **Object,
        _OB_EXTENDED_CREATION_INFO *ExtendedInfo){
  struct _KPRCB *CurrentPrcb; 
  INT8 v11; 
  INT8 v12; 
  _GENERAL_LOOKASIDE *P; 
  _OBJECT_CREATE_INFORMATION *v16; 
  int v17; 
  unsigned int DefaultPagedPoolCharge; 
  unsigned int DefaultNonPagedPoolCharge; 
  int v20; 
  _OBJECT_HEADER *v21; 
  _GENERAL_LOOKASIDE *L; 
  __int64 Size; 
  void *(__fastcall *AllocateEx)(_POOL_TYPE, unsigned __int64, unsigned int, _LOOKASIDE_LIST_EX *); 
  __int64 Tag; 
  __int64 Type; 
  VOID *SecurityDescriptor; 
  struct _KPRCB *v29; 
  _GENERAL_LOOKASIDE *v30; 
  struct _KPRCB *v31; 
  _GENERAL_LOOKASIDE *v32; 
  _OBJECT_CREATE_INFORMATION *ObjectCreateInfo; 
  INT64 UseLookaside; 
  _OB_EXTENDED_CREATION_INFO *v35; 
  _UNICODE_STRING CapturedObjectName; 

  CurrentPrcb = KeGetCurrentPrcb();
  v11 = ProbeMode;
  v12 = OwnershipMode;
  ParseContext = 0i64;
  P = CurrentPrcb->PPLookasideList[4].P;
  CapturedObjectName = 0i64;
  ++P->TotalAllocates;
  v16 = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList(&P->ListHead);
  if( !v16 )
  {
    ++P->AllocateMisses;
    L = CurrentPrcb->PPLookasideList[4].L;
    ++L->TotalAllocates;
    v16 = (_OBJECT_CREATE_INFORMATION *)RtlpInterlockedPopEntrySList(&L->ListHead);
    if( !v16 )
    {
      Size = L->Size;
      AllocateEx = L->AllocateEx;
      Tag = L->Tag;
      Type = (unsigned int)L->Type;
      ++L->AllocateMisses;
      v16 = (_OBJECT_CREATE_INFORMATION *)((__int64(__fastcall *)(__int64, __int64, __int64))AllocateEx)(
                                            Type,
                                            Size,
                                            Tag);
      if( !v16 )
        return -1073741670;
    }
  }
  LODWORD(UseLookaside) = 0;
  v16->Attributes = CurrentPrcb->Number;
  v17 = ObpCaptureObjectCreateInformation(v11, v12, ObjectAttributes, &CapturedObjectName, v16, UseLookaside);
  if( v17 >= 0 )
  {
    if( (v16->Attributes & ObjectType->TypeInfo.InvalidAttributes) != 0 )
    {
      v20 = -1073741811;
    }
    else if( (v16->Attributes & 0x10) == 0 || SeSinglePrivilegeCheck(*(_QWORD *)&SeCreatePermanentPrivilege, v11) )
    {
      DefaultPagedPoolCharge = PagedPoolCharge;
      if( !(_DWORD)PagedPoolCharge )
        DefaultPagedPoolCharge = ObjectType->TypeInfo.DefaultPagedPoolCharge;
      DefaultNonPagedPoolCharge = NonPagedPoolCharge;
      if( !(_DWORD)NonPagedPoolCharge )
        DefaultNonPagedPoolCharge = ObjectType->TypeInfo.DefaultNonPagedPoolCharge;
      v16->PagedPoolCharge = DefaultPagedPoolCharge;
      v35 = ExtendedInfo;
      v16->NonPagedPoolCharge = DefaultNonPagedPoolCharge;
      LODWORD(ObjectCreateInfo) = ObjectBodySize;
      v20 = ObpAllocateObject(
              v16,
              v12,
              ObjectType,
              &CapturedObjectName,
              (UINT64)ObjectCreateInfo,
              (_OBJECT_HEADER **)&ParseContext,
              v35);
      if( v20 >= 0 )
      {
        v21 = (_OBJECT_HEADER *)ParseContext;
        if( ObpTraceFlags )
        {
          ObpRegisterObject((_OBJECT_HEADER *)ParseContext);
          ObpPushStackInfo(v21, 1u, 1ui64, 0x746C6644ui64);
        }
        *Object = &v21->Body;
        return v20;
      }
    }
    else
    {
      v20 = -1073741727;
    }
    if( CapturedObjectName.Buffer )
      ObpFreeObjectNameBuffer(&CapturedObjectName);
    SecurityDescriptor = v16->SecurityDescriptor;
    if( SecurityDescriptor )
    {
      SeReleaseSecurityDescriptor(SecurityDescriptor, v16->ProbeMode, 1u);
      v16->SecurityDescriptor = 0i64;
    }
    v29 = KeGetCurrentPrcb();
    v30 = v29->PPLookasideList[4].P;
    ++v30->TotalFrees;
    if( LOWORD(v30->ListHead.Alignment) < v30->Depth
      || (++v30->FreeMisses,
          v30 = v29->PPLookasideList[4].L,
          ++v30->TotalFrees,
          LOWORD(v30->ListHead.Alignment) < v30->Depth) )
    {
      RtlpInterlockedPushEntrySList(&v30->ListHead, (PSLIST_ENTRY)v16);
    }
    else
    {
      ++v30->FreeMisses;
      ((void(__fastcall *)(_OBJECT_CREATE_INFORMATION *))v30->FreeEx)(v16);
    }
    return v20;
  }
  v31 = KeGetCurrentPrcb();
  v32 = v31->PPLookasideList[4].P;
  ++v32->TotalFrees;
  if( LOWORD(v32->ListHead.Alignment) < v32->Depth
    || (++v32->FreeMisses,
        v32 = v31->PPLookasideList[4].L,
        ++v32->TotalFrees,
        LOWORD(v32->ListHead.Alignment) < v32->Depth) )
  {
    RtlpInterlockedPushEntrySList(&v32->ListHead, (PSLIST_ENTRY)v16);
  }
  else
  {
    ++v32->FreeMisses;
    ((void(__fastcall *)(_OBJECT_CREATE_INFORMATION *))v32->FreeEx)(v16);
  }
  return v17;
}

Referenced by: