ObpDecrementHandleCount

void __fastcall ObpDecrementHandleCount(ULONG_PTR BugCheckParameter1, __int64 a2){
  unsigned __int64 v4; 
  __int64 v5; 
  signed __int64 v6; 
  _ETHREAD *CurrentThread; 
  void(__fastcall *v8)(ULONG_PTR, __int64, _QWORD, signed __int64); 
  char v9; 
  _EJOB *v10; 
  _EJOB *ProcessServerSilo; 
  _KAPC_STATE ApcState; 
  v4 = (unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(a2 + 24) ^ (unsigned __int64)BYTE1(a2);
  memset(&ApcState, 0, sizeof(ApcState));
  v5 = ObTypeIndexTable[v4];
  if( (*(_BYTE *)(v5 + 66) & 0x10) != 0 || (*(_BYTE *)(a2 + 27) & 8) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx(a2 + 16, 0i64);
    v6 = *(_QWORD *)(a2 + 8);
    if( _InterlockedExchangeAdd64((volatile signed __int64 *)(a2 + 8), 0xFFFFFFFFFFFFFFFFui64) == 1
      && (*(_BYTE *)(a2 + 27) & 8) != 0 )
    {
      *(_QWORD *)(a2 - *((unsigned __int8 *)ObpInfoMaskToOffset + (*(_BYTE *)(a2 + 26) & 0x1F))) = 0i64;
    }
    if( (*(_BYTE *)(v5 + 66) & 0x10) != 0 )
      ObpReleaseHandleInfo(a2);
    ExReleasePushLockEx(a2 + 16, 0i64);
    KeLeaveCriticalRegion();
  }
  else
  {
    v6 = _InterlockedExchangeAdd64((volatile signed __int64 *)(a2 + 8), 0xFFFFFFFFFFFFFFFFui64);
  }
  v8 = *(void(__fastcall **)(ULONG_PTR, __int64, _QWORD, signed __int64))(v5 + 128);
  if( v8 )
  {
    v9 = 0;
    v10 = 0i64;
    if( *((_QWORD *)KeGetCurrentThread() + 23) != BugCheckParameter1 )
    {
      v9 = 1;
      ProcessServerSilo = (_EJOB *)PsGetProcessServerSilo(BugCheckParameter1);
      v10 = PsAttachSiloToCurrentThread(ProcessServerSilo);
      KiStackAttachProcess((_KPROCESS *)BugCheckParameter1, 0i64, &ApcState);
      v8 = *(void(__fastcall **)(ULONG_PTR, __int64, _QWORD, signed __int64))(v5 + 128);
    }
    v8(BugCheckParameter1, a2 + 48, 0i64, v6);
    if( v9 )
    {
      KiUnstackDetachProcess(&ApcState, 0i64);
      PsDetachSiloFromCurrentThread(v10);
    }
  }
  if( v6 == 1 )
    ObpDeleteNameCheck(a2);
  _InterlockedAdd((volatile signed __int32 *)(v5 + 48), 0xFFFFFFFF);
}

Referenced by: