ObpPreInterceptHandleCreate

NTSTATUS __stdcall ObpPreInterceptHandleCreate(
        PVOID Object,
        INT8 KernelHandle,
        INT64 *DesiredAccess,
        LIST_ENTRY *ThreadCallbackListHead){
  unsigned __int64 v6; 
  int v8; 
  __int64 v9; 
  int v10; 
  int v11; 
  NTSTATUS result; 
  int v13[2]; 
  __int128 v14; 
  int v15; 
  int v16; 
  PVOID v17; 
  __int64 v18; 
  __int64 v19; 
  int *v20; 
  v6 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  v16 = 0;
  v8 = *(_DWORD *)DesiredAccess;
  v14 = 0i64;
  v9 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v6];
  v10 = *(_DWORD *)(v9 + 96);
  v20 = v13;
  v11 = v8 & v10;
  v13[1] = v8;
  v13[0] = v8;
  v15 = 1;
  v17 = Object;
  v16 = KernelHandle & 1;
  v19 = 0i64;
  v14 = 0i64;
  v18 = v9;
  result = ObpCallPreOperationCallbacks(v9, (__int64)&v15, ThreadCallbackListHead);
  if( result >= 0 && !KernelHandle )
    *(_DWORD *)DesiredAccess &= v11 | v13[0];
  return result;
}

Referenced by: