ObQueryObjectAuditingByHandle

NTSTATUS __stdcall ObQueryObjectAuditingByHandle(PVOID Handle, UINT8 *GenerateOnClose){
  _ETHREAD *CurrentThread; 
  unsigned __int64 v4; 
  char v5; 
  struct _EX_RUNDOWN_REF *v6; 
  void *v7; 
  INT64 v8; 
  _HANDLE_TABLE *Count; 
  _HANDLE_TABLE_ENTRY *v10; 
  __int64 v11; 
  NTSTATUS v12; 
  int v14[14]; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = (unsigned __int64)Handle;
  v5 = 0;
  v6 = (struct _EX_RUNDOWN_REF *)*((_QWORD *)CurrentThread + 23);
  if( ObpIsKernelHandle(Handle, *((_BYTE *)CurrentThread + 562)) )
  {
    Count = (_HANDLE_TABLE *)ObpKernelHandleTable;
    v4 ^= 0xFFFFFFFF80000000ui64;
  }
  else if( *((_BYTE *)KeGetCurrentThread() + 586) == 1 )
  {
    Count = (_HANDLE_TABLE *)ObReferenceProcessHandleTable(v6);
    if( !Count )
      return -1073741816;
    v5 = 1;
  }
  else
  {
    Count = (_HANDLE_TABLE *)v6[174].Count;
  }
  --*((_WORD *)CurrentThread + 242);
  v10 = ExMapHandleToPointer(Count, (VOID *)v4, v7, v8, *(INT64 *)&v14[8], *(INT64 *)&v14[10], *(PVOID *)&v14[12]);
  if( v10 )
  {
    v11 = v10->LowValue >> 17;
    _InterlockedExchangeAdd64(&v10->VolatileLowValue, 1ui64);
    _InterlockedOr(v14, 0);
    if( Count->HandleContentionEvent.Value )
      ExfUnblockPushLock(&Count->HandleContentionEvent, 0i64);
    *GenerateOnClose = (v11 & 4) != 0;
    v12 = 0;
  }
  else
  {
    v12 = -1073741816;
  }
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  if( v5 )
    ExReleaseRundownProtection(v6 + 139);
  return v12;
}

Referenced by: