ObAuditInheritedHandleProcedure

VOID __fastcall ObAuditInheritedHandleProcedure(VOID **a1){
  volatile signed __int64 *v1; 
  void *v2; 
  _EPROCESS **v3; 
  _EPROCESS **v4; 
  void *v5; 
  __int64 v6; 
  _EX_PUSH_LOCK *v7; 
  int v8[10]; 
  v4 = v3;
  v5 = v2;
  v6 = ((__int64)*(unsigned int *)v1 >> 17) & 4;
  _InterlockedExchangeAdd64(v1, 1ui64);
  v7 = (_EX_PUSH_LOCK *)(a1 + 6);
  _InterlockedOr(v8, 0);
  if( v7->Value )
    ExfUnblockPushLock(v7, 0i64);
  if( (_DWORD)v6 )
    SeAuditHandleDuplication(v5, v5, v4[1], *v4);
}

Referenced by: