ObpHandleRevocationBlockRemoveInsertedObject
VOID __fastcall ObpHandleRevocationBlockRemoveInsertedObject(INT64 *a1, EX_RUNDOWN_REF *a2, INT64 a3, CHAR a4){
_ETHREAD *CurrentThread;
INT64 v9;
INT64 **v10;
if( a2 == (EX_RUNDOWN_REF *)_InterlockedCompareExchange64(a1 + 2, 2i64, (signed __int64)a2) )
{
if( !a4 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)&a2[2], 0i64);
}
v9 = *a1;
if( *(INT64 **)(*a1 + 8) != a1 || (v10 = (INT64 **)a1[1], *v10 != a1) )
__fastfail(3u);
*v10 = (INT64 *)v9;
*(_QWORD *)(v9 + 8) = v10;
if( !a4 )
{
ExReleasePushLockEx((UINT64)&a2[2], 0i64);
KeLeaveCriticalRegion();
}
ExReleaseRundownProtection(a2 + 3);
a1[2] = a3;
}
}Referenced by:
ObDestroyHandleRevocationBlock
ObRevokeHandles
ObpHandleRevocationBlockRemoveObject