IopCheckInitiatorHint

INT64 __stdcall IopCheckInitiatorHint(_FILE_OBJECT *FileObject, _FILE_OBJECT *RelatedFileObject){
  _ETHREAD *CurrentThread; 
  _QWORD *v5; 
  __int64 v6; 
  char v7; 
  int v8; 
  _EPROCESS *InitiatorProcess; 
  NTSTATUS v11; 
  PVOID Object; 
  PVOID TypeExt; 
  v11 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*((_DWORD *)CurrentThread + 29) & 0x400) != 0 || *((_BYTE *)CurrentThread + 586) == 1 )
    v5 = 0i64;
  else
    v5 = (_QWORD *)*((_QWORD *)CurrentThread + 30);
  if( (v5[9] | 1i64) == v5[252] && !(unsigned __int8)RtlIsSandboxedToken(0i64, *((_BYTE *)KeGetCurrentThread() + 562)) )
  {
    v6 = v5[251];
    v7 = v6;
    Object = 0i64;
    v11 = ObReferenceObjectByHandle(
            (HANDLE)(v6 & 0xFFFFFFFFFFFFFFFEui64),
            1u,
            (POBJECT_TYPE)PsProcessType,
            1,
            &Object,
            0i64);
    if( v11 >= 0 )
    {
      TypeExt = 0i64;
      IopGetSetSpecificExtension(FileObject, FoExtTypeInternal, 0x20ui64, 1u, &TypeExt, 0i64);
      v11 = v8;
      if( v8 < 0 )
      {
        ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
      }
      else
      {
        if( RelatedFileObject )
        {
          InitiatorProcess = IoGetInitiatorProcess(RelatedFileObject);
          if( InitiatorProcess != Object )
          {
            v11 = -1073741811;
            ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
          }
        }
        if( v11 >= 0 )
        {
          *((_QWORD *)TypeExt + 1) = Object;
          if( (v7 & 1) != 0 )
          {
            FileObject->Flags |= 0x20000000u;
            IopSetFileObjectExtensionFlag(FileObject, 8ui64, 0);
          }
        }
      }
    }
  }
  return(unsigned int)v11;
}

Referenced by: