IopCheckHandleForRevocation

UINT8 __stdcall IopCheckHandleForRevocation(
        _HANDLE_TABLE *ObjectTable,
        _HANDLE_TABLE_ENTRY *ObjectTableEntry,
        VOID *HandleId,
        _IOP_REVOCATION_CONTEXT *RevocationContext){
  int v7[10]; 

  if( (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(((ObjectTableEntry->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64)
                                                                                             + 0x18) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)(WORD1(ObjectTableEntry->LowValue) & 0xFFF0) >> 8)] == IoFileObjectType
    && *(_QWORD *)(((ObjectTableEntry->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64) + 0x38) == *(_QWORD *)RevocationContext )
  {
    IopRevokeFileObjectForProcess(
      (_FILE_OBJECT *)(((ObjectTableEntry->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64) + 48),
      *((_EPROCESS **)RevocationContext + 1));
  }
  _InterlockedExchangeAdd64(&ObjectTableEntry->VolatileLowValue, 1ui64);
  _InterlockedOr(v7, 0);
  if( ObjectTable->HandleContentionEvent._bf_0 )
    ExpUnblockPushLock(&ObjectTable->HandleContentionEvent, 0i64, 0);
  return 0;
}

Referenced by: