ObpGetWaitObject
VOID *__stdcall ObpGetWaitObject(_OBJECT_HEADER *ObjectHeader){
_QUAD *p_Body;
__int64 v2;
VOID *result;
p_Body = &ObjectHeader->Body;
v2 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ ObjectHeader->TypeIndex ^ (unsigned __int64)BYTE1(ObjectHeader)];
result = *(VOID **)(v2 + 32);
if( ((unsigned __int8)result & 1) != 0 )
{
if( ((unsigned __int8)result & 2) != 0 )
{
if( (*(_DWORD *)(v2 + 176) & *(_DWORD *)((_BYTE *)&p_Body->DoNotUseThisField + *(unsigned __int16 *)(v2 + 180))) == *(_DWORD *)(v2 + 176) )
return *(VOID **)((char *)&p_Body->UseThisFieldToCopy + *(unsigned __int16 *)(v2 + 182));
else
return(char *)result + (_QWORD)p_Body - 3;
}
else
{
return *(VOID **)((char *)p_Body + (_QWORD)result - 1);
}
}
else if( (__int64)result >= 0 )
{
return(char *)result + (_QWORD)p_Body;
}
return result;
}Referenced by:
IopCancelWaitCompletionPacket
NtAssociateWaitCompletionPacket
NtSignalAndWaitForSingleObject
ObWaitForSingleObject