AlpcpCaptureDirectAttribute32

INT64 __fastcall AlpcpCaptureDirectAttribute32(UINT64 *a1, VOID *a2, INT64 a3, INT64 a4, INT64 a5){
  char v6; 
  NTSTATUS v7; 
  void *v9; 
  PVOID Object; 
  Object = a2;
  v6 = _bittest((const signed __int32 *)&a5, 0x1Du) & ((a4 & 0x10010) == 0);
  v7 = v6 == 0 ? 0xC000000D : 0;
  if( v6 )
  {
    v9 = (void *)*(unsigned int *)a1;
    Object = 0i64;
    v7 = ObReferenceObjectByHandle(v9, 2u, (POBJECT_TYPE)ExEventObjectType, 1, &Object, 0i64);
    if( v7 >= 0 )
      *(_QWORD *)(a3 + 56) = (unsigned __int64)Object | 3;
  }
  return(unsigned int)v7;
}

Referenced by: