PspCreateObjectHandle

INT64 __fastcall PspCreateObjectHandle(VOID *a1, INT64 a2, struct OBJECT_TYPE *a3){
  PVOID *v3; 
  NTSTATUS v5; 
  _PRIVILEGE_SET *v6; 
  v3 = (PVOID *)(a2 + 392);
  v5 = ObOpenObjectByPointer(
         a1,
         *(_DWORD *)(a2 + 384),
         (PACCESS_STATE)a2,
         0,
         (POBJECT_TYPE)a3,
         *(_BYTE *)(a2 + 388),
         (PHANDLE)(a2 + 392));
  if( v5 >= 0 )
  {
    v6 = **(_PRIVILEGE_SET ***)(a2 + 72);
    if( v6 )
    {
      if( v6->PrivilegeCount )
        SePrivilegeObjectAuditAlarm(
          *v3,
          (_SECURITY_SUBJECT_CONTEXT *)(a2 + 32),
          *(unsigned int *)(a2 + 20),
          v6,
          1u,
          *(_BYTE *)(a2 + 388));
    }
  }
  return(unsigned int)v5;
}

Referenced by: