ObpAuditObjectAccess

CHAR __fastcall ObpAuditObjectAccess(INT64 a1, VOID *a2, volatile INT64 *a3, UINT8 *a4, INT64 a5){
  _HANDLE_TABLE_ENTRY_INFO *HandleExtraInfo; 
  _ETHREAD *CurrentThread; 
  CHAR v11; 
  unsigned int AuditMask; 
  int v13; 
  __int64 v14; 
  UINT8 *v15; 
  unsigned __int64 v16; 
  signed __int32 v18[8]; 
  VOID *SecurityDescriptor; 
  __int64 v20; 
  if( !*(_DWORD *)(a1 + 4) )
    return 1;
  HandleExtraInfo = ExpGetHandleExtraInfo((_HANDLE_TABLE *)a1, a2);
  if( !HandleExtraInfo )
    return 1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  if( ExLockHandleTableEntry(a1, (signed __int64 *)a3) )
  {
    _m_prefetchw(HandleExtraInfo);
    AuditMask = HandleExtraInfo->AuditMask;
    if( a4 == (UINT8 *)((*(__int64 *)a3 >> 16) & 0xFFFFFFFFFFFFFFF0ui64) )
    {
      v13 = a5 & AuditMask;
      if( ((unsigned int)a5 & AuditMask) != 0 )
      {
        v14 = 0i64;
        HandleExtraInfo->AuditMask = AuditMask & ~(_DWORD)a5;
        if( (a4[26] & 0x20) != 0 )
          v15 = &a4[-*((unsigned __int8 *)ObpInfoMaskToOffset + (a4[26] & 0x3F))];
        else
          v15 = 0i64;
        if( v15 )
          v14 = *(_QWORD *)v15;
        v20 = v14;
        v16 = a4[24] ^ (unsigned __int64)BYTE1(a4);
        LODWORD(SecurityDescriptor) = v13;
        SeOperationAuditAlarm(
          v15,
          a4 + 48,
          (UNICODE_STRING *)a2,
          ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v16] + 16,
          SecurityDescriptor);
      }
      v11 = 1;
    }
    else
    {
      v11 = 0;
    }
    _InterlockedExchangeAdd64(a3, 1ui64);
    _InterlockedOr(v18, 0);
    if( *(_QWORD *)(a1 + 48) )
      ExfUnblockPushLock((_EX_PUSH_LOCK *)(a1 + 48), 0i64);
  }
  else
  {
    v11 = 0;
  }
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v11;
}

Referenced by: