ObQueryTypeInfo

INT64 __fastcall ObQueryTypeInfo(INT64 a1, INT64 a2, UINT64 a3, UINT64 *a4){
  unsigned int v6; 
  v6 = -1073741820;
  *(_DWORD *)a4 += ((*(unsigned __int16 *)(a1 + 16) + 9) & 0xFFFFFFF8) + 104;
  if( (unsigned int)a3 >= *(_DWORD *)a4 )
  {
    *(_DWORD *)(a2 + 16) = *(_DWORD *)(a1 + 44);
    *(_DWORD *)(a2 + 20) = *(_DWORD *)(a1 + 48);
    *(_DWORD *)(a2 + 40) = *(_DWORD *)(a1 + 52);
    *(_DWORD *)(a2 + 44) = *(_DWORD *)(a1 + 56);
    *(_DWORD *)(a2 + 64) = *(_DWORD *)(a1 + 72);
    *(_OWORD *)(a2 + 68) = *(_OWORD *)(a1 + 76);
    *(_DWORD *)(a2 + 84) = *(_DWORD *)(a1 + 92);
    *(_BYTE *)(a2 + 88) = (*(_BYTE *)(a1 + 66) & 8) != 0;
    *(_BYTE *)(a2 + 89) = (*(_BYTE *)(a1 + 66) & 0x10) != 0;
    *(_DWORD *)(a2 + 92) = *(_DWORD *)(a1 + 100);
    *(_DWORD *)(a2 + 96) = *(_DWORD *)(a1 + 104);
    *(_DWORD *)(a2 + 100) = *(_DWORD *)(a1 + 108);
    *(_BYTE *)(a2 + 90) = *(_BYTE *)(a1 + 40);
    v6 = 0;
    *(_BYTE *)(a2 + 91) = 0;
    *(_QWORD *)(a2 + 8) = a2 + 104;
    *(_WORD *)a2 = *(_WORD *)(a1 + 16);
    *(_WORD *)(a2 + 2) = *(_WORD *)(a1 + 16) + 2;
    memmove((UINT8 *)(a2 + 104), *(UINT8 **)(a1 + 24), *(unsigned __int16 *)(a1 + 16));
    *(_WORD *)(a2 + 2 * ((unsigned __int64)*(unsigned __int16 *)(a1 + 16) >> 1) + 104) = 0;
  }
  return v6;
}

Referenced by:

NtQueryObject