NtQueryMutant

NTSTATUS __fastcall NtQueryMutant(_HANDLE Handle, INT64 a2, _CLIENT_ID *a3, UINT64 a4, INT64 a5){
  int v6; 
  VOID *v7; 
  char PreviousMode; 
  _DWORD *v10; 
  INT64 v11; 
  int v12; 
  int v13; 
  char v14; 
  bool v15; 
  PVOID Object; 
  _CLIENT_ID ClientId; 

  v6 = a2;
  v7 = *(VOID **)&Handle;
  ClientId = 0i64;
  if( !(_DWORD)a2 )
  {
    if( (_DWORD)a4 == 8 )
      goto LABEL_7;
    return -1073741820;
  }
  if( (_DWORD)a2 != 1 )
    return -1073741821;
  if( (_DWORD)a4 != 16 )
    return -1073741820;
LABEL_7:
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    ProbeForWrite((UINT64)a3, (unsigned int)a4, 4i64);
    v10 = (_DWORD *)a5;
    if( a5 )
    {
      v11 = 0x7FFFFFFF0000i64;
      if( (unsigned __int64)a5 < 0x7FFFFFFF0000i64 )
        v11 = a5;
      *(_DWORD *)v11 = *(_DWORD *)v11;
    }
  }
  else
  {
    v10 = (_DWORD *)a5;
  }
  Object = 0i64;
  v12 = ObReferenceObjectByHandle(v7, 1ui64, ExMutantObjectType, PreviousMode, &Object, 0i64);
  if( v12 >= 0 )
  {
    if( v6 )
    {
      KeQueryOwnerMutant((PKMUTANT)Object, &ClientId);
      if( PreviousMode )
      {
        *a3 = ClientId;
        if( v10 )
          *v10 = 16;
      }
      else
      {
        *a3 = ClientId;
        if( v10 )
          *v10 = 16;
      }
    }
    else
    {
      v13 = *((_DWORD *)Object + 1);
      v14 = *((_BYTE *)Object + 48) & 1;
      v15 = *((_QWORD *)Object + 5) == (_QWORD)KeGetCurrentThread();
      if( PreviousMode )
      {
        LODWORD(a3->UniqueProcess) = v13;
        BYTE4(a3->UniqueProcess) = v15;
        BYTE5(a3->UniqueProcess) = v14;
        if( v10 )
          *v10 = 8;
      }
      else
      {
        LODWORD(a3->UniqueProcess) = v13;
        BYTE4(a3->UniqueProcess) = v15;
        BYTE5(a3->UniqueProcess) = v14;
        if( v10 )
          *v10 = 8;
      }
    }
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  }
  return v12;
}

Referenced by: