ObpRegisterObject

VOID __stdcall ObpRegisterObject(_OBJECT_HEADER *ObjectHeader){
  _ETHREAD *CurrentThread; 
  _OBJECT_REF_INFO *v3; 
  _OBJECT_REF_INFO *PoolWithTag; 
  unsigned int v5; 
  _OBJECT_REF_INFO *v6; 
  char v7; 
  unsigned __int8 v8; 
  _OBJECT_REF_INFO *RefInfo; 

  if( (xmmword_140CFB490 & 0x80u) != 0i64 )
    EtwTraceObject(0x1130u, ObjectHeader);
  if( (ObpTraceFlags & 0x73) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    RefInfo = 0i64;
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx(&stru_140C25A40, 0i64);
    if( (ObpTraceFlags & 0x73) != 0
      && ((ObpTraceFlags & 0x20) == 0 || (KeGetCurrentThread()->ApcState.Process->Flags2 & 0x200) != 0)
      && ObpIsObjectPoolTagTraced(ObjectHeader)
      && ObpGetObjectRefInfo(ObjectHeader, &RefInfo) >= 0 )
    {
      v3 = RefInfo;
      if( RefInfo )
        goto LABEL_12;
      PoolWithTag = (_OBJECT_REF_INFO *)ExAllocatePoolWithTag(0x200ui64, 0x17F8ui64, 1951556175i64);
      RefInfo = PoolWithTag;
      v3 = PoolWithTag;
      if( PoolWithTag )
      {
        v5 = (((unsigned int)((_DWORD)ObjectHeader + 48) >> 4) & 0xFFFFF) % 0x191;
        PoolWithTag->NextRef = (void *)*((_QWORD *)ObjectTable + v5);
        *((_QWORD *)ObjectTable + v5) = PoolWithTag;
        PoolWithTag->MaxStacks = 508;
LABEL_12:
        ++dword_140C25A14;
        v3->ObjectHeader = ObjectHeader;
        v6 = RefInfo;
        RtlStringCbCopyA(
          (INT8 *)RefInfo->ImageFileName,
          0x10ui64,
          (INT8 *)KeGetCurrentThread()->ApcState.Process->ImageFileName);
        v6->NextPos = 0;
        memset(v6->StackInfo, 0i64, 12 * v6->MaxStacks);
        v7 = ObpTraceFlags;
        v8 = ObjectHeader->TraceFlags | 1;
        ObjectHeader->TraceFlags = v8;
        if( (v7 & 0x40) != 0 )
          ObjectHeader->TraceFlags = v8 | 2;
      }
    }
    if( (_InterlockedExchangeAdd64(&stru_140C25A40._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&stru_140C25A40);
    KeAbPostRelease(&stru_140C25A40);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  }
}

Referenced by: