ObpDecrementHandleCount

VOID __stdcall ObpDecrementHandleCount(_EPROCESS *Process, _OBJECT_HEADER *ObjectHeader){
  unsigned __int64 v4; 
  __int64 v5; 
  __int64 HandleCount; 
  _ETHREAD *CurrentThread; 
  void(__fastcall *v8)(_EPROCESS *, _QUAD *, _QWORD, __int64); 
  char v9; 
  _EJOB *v10; 
  INT64 v11; 
  _EJOB *v12; 
  UINT64 ProcessHandleCount; 
  _KAPC_STATE ApcState; 

  LODWORD(ProcessHandleCount) = 0;
  v4 = (unsigned __int8)ObHeaderCookie ^ ObjectHeader->TypeIndex ^ (unsigned __int64)BYTE1(ObjectHeader);
  memset(&ApcState, 0, sizeof(ApcState));
  v5 = ObTypeIndexTable[v4];
  if( (*(_BYTE *)(v5 + 66) & 0x10) != 0 || (ObjectHeader->Flags & 8) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&ObjectHeader->Lock, 0i64);
    HandleCount = ObjectHeader->HandleCount;
    if( _InterlockedExchangeAdd64(&ObjectHeader->HandleCount, 0xFFFFFFFFFFFFFFFFui64) == 1
      && (ObjectHeader->Flags & 8) != 0 )
    {
      *(__int64 *)((char *)&ObjectHeader->PointerCount
                 - *((unsigned __int8 *)&dword_140C25D60 + (ObjectHeader->InfoMask & 0x1F))) = 0i64;
    }
    if( (*(_BYTE *)(v5 + 66) & 0x10) != 0 )
      ObpReleaseHandleInfo(ObjectHeader, Process, &ProcessHandleCount);
    ExReleasePushLockEx((_DWORD)ObjectHeader + 16, 0);
    KeLeaveCriticalRegion();
  }
  else
  {
    HandleCount = _InterlockedExchangeAdd64(&ObjectHeader->HandleCount, 0xFFFFFFFFFFFFFFFFui64);
  }
  v8 = *(void(__fastcall **)(_EPROCESS *, _QUAD *, _QWORD, __int64))(v5 + 128);
  if( v8 )
  {
    v9 = 0;
    v10 = 0i64;
    if( KeGetCurrentThread()->ApcState.Process != Process )
    {
      v9 = 1;
      LODWORD(v11) = PsGetProcessServerSilo((INT64)Process);
      LODWORD(v12) = PsAttachSiloToCurrentThread(v11);
      v10 = v12;
      KiStackAttachProcess(Process, 0i64, &ApcState);
      v8 = *(void(__fastcall **)(_EPROCESS *, _QUAD *, _QWORD, __int64))(v5 + 128);
    }
    v8(Process, &ObjectHeader->Body, (unsigned int)ProcessHandleCount, HandleCount);
    if( v9 )
    {
      KiUnstackDetachProcess(&ApcState, 0i64);
      PsDetachSiloFromCurrentThread(v10);
    }
  }
  if( HandleCount == 1 )
    ObpDeleteNameCheck(ObjectHeader);
  _InterlockedAdd((volatile signed __int32 *)(v5 + 48), 0xFFFFFFFF);
}

Referenced by: