ObpPreInterceptHandleDuplicate

NTSTATUS __stdcall ObpPreInterceptHandleDuplicate(
        PVOID Object,
        UINT8 KernelHandle,
        UINT64 *DesiredAccess,
        PVOID SourceProcess,
        PVOID TargetProcess,
        LIST_ENTRY *ThreadCallbackListHead){
  int v8; 
  __int64 v10; 
  int v11; 
  int v12; 
  NTSTATUS result; 
  int v14[2]; 
  PVOID v15; 
  PVOID v16; 
  int v17; 
  int v18; 
  PVOID v19; 
  __int64 v20; 
  __int64 v21; 
  int *v22; 
  v18 = 0;
  v8 = *(_DWORD *)DesiredAccess;
  v10 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
  v11 = *(_DWORD *)(v10 + 96);
  v21 = 0i64;
  v12 = v8 & v11;
  v22 = v14;
  v14[1] = v8;
  v14[0] = v8;
  v18 = KernelHandle & 1;
  v17 = 2;
  v19 = Object;
  v20 = v10;
  v15 = SourceProcess;
  v16 = TargetProcess;
  result = ObpCallPreOperationCallbacks(v10, (__int64)&v17, ThreadCallbackListHead);
  if( result >= 0 && !KernelHandle )
    *(_DWORD *)DesiredAccess &= v12 | v14[0];
  return result;
}

Referenced by: