ObInitProcess

__int64 __fastcall ObInitProcess(struct _EX_RUNDOWN_REF *a1, ULONG_PTR a2, unsigned int a3, _BYTE *a4){
  _HANDLE_TABLE *v8; 
  int v9; 
  unsigned int *HandleTable; 
  _HANDLE_TABLE *v12; 
  __int64 v13[5]; 
  PVOID P; 
  P = 0i64;
  if( !a1 )
  {
    v8 = 0i64;
    HandleTable = (unsigned int *)ExCreateHandleTable(a2, 1i64);
LABEL_5:
    if( HandleTable )
    {
      *(_QWORD *)(a2 + 1392) = HandleTable;
      if( (unsigned __int8)SeAuditingWithTokenForSubcategory(0x7Bui64, 0i64) )
      {
        v13[0] = a2;
        v13[1] = (__int64)a1;
        ExEnumHandleTable(
          HandleTable,
          (__int64(__fastcall *)(unsigned int *, __int64 *, __int64, __int64))ObAuditInheritedHandleProcedure,
          (__int64)v13,
          0i64);
      }
      if( v8 )
        ExReleaseRundownProtection(a1 + 139);
      return 0i64;
    }
    else
    {
      *(_QWORD *)(a2 + 1392) = 0i64;
      if( v8 )
        ExReleaseRundownProtection(a1 + 139);
      return 3221225626i64;
    }
  }
  v8 = (_HANDLE_TABLE *)ObReferenceProcessHandleTable(a1);
  if( !v8 )
    return 3221225738i64;
  v9 = ExDupHandleTable((_EPROCESS *)a2, v8, a3, (VOID **)a4, (_HANDLE_TABLE **)&P);
  if( v9 >= 0 )
  {
    HandleTable = (unsigned int *)P;
    goto LABEL_5;
  }
  ExReleaseRundownProtection(a1 + 139);
  v12 = (_HANDLE_TABLE *)P;
  if( P )
  {
    ExSweepHandleTable((_EPROCESS *)a2, (_HANDLE_TABLE *)P, 0);
    ExpRemoveHandleTable((__int64)v12);
    ExpFreeHandleTable(v12);
  }
  return(unsigned int)v9;
}

Referenced by: