IoRegisterLastChanceShutdownNotification

NTSTATUS __stdcall IoRegisterLastChanceShutdownNotification(_DEVICE_OBJECT *DeviceObject){
  VOID **PoolWithTag; 

  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x18ui64, 1750298441i64);
  if( !PoolWithTag )
    return -1073741670;
  ObfReferenceObject(DeviceObject);
  PoolWithTag[2] = DeviceObject;
  IopInterlockedInsertHeadList((char *)&stru_140C452E0 + 1600, PoolWithTag);
  DeviceObject->Flags |= 0x800u;
  IopLogAuditIoRegisterNotificationEvent(
    &KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION,
    (INT64)DeviceObject);
  return 0;
}

Referenced by: