IopCheckInitiatorHint

NTSTATUS __stdcall IopCheckInitiatorHint(_FILE_OBJECT *FileObject, _FILE_OBJECT *RelatedFileObject){
  _ETHREAD *CurrentThread; 
  _QWORD *Teb; 
  __int64 v6; 
  char v7; 
  int v8; 
  _EPROCESS *InitiatorProcess; 
  int v11; 
  PVOID Object; 
  VOID *TypeExt; 

  v11 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (CurrentThread->Tcb._bf_0 & 0x400) != 0 || CurrentThread->Tcb.ApcStateIndex == 1 )
    Teb = 0i64;
  else
    Teb = CurrentThread->Tcb.Teb;
  if( (Teb[9] | 1i64) == Teb[252] && !(unsigned __int8)RtlIsSandboxedToken(InterruptControllerInvalid) )
  {
    v6 = Teb[251];
    v7 = v6;
    Object = 0i64;
    v11 = ObReferenceObjectByHandle(
            (VOID *)(v6 & 0xFFFFFFFFFFFFFFFEui64),
            1ui64,
            (_OBJECT_TYPE *)PsProcessType,
            1,
            &Object,
            0i64);
    if( v11 >= 0 )
    {
      TypeExt = 0i64;
      IopGetSetSpecificExtension(FileObject, FoExtTypeInternal, 0x20ui64, 1u, &TypeExt, 0i64);
      v11 = v8;
      if( v8 < 0 )
      {
        ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
      }
      else
      {
        if( RelatedFileObject )
        {
          InitiatorProcess = IoGetInitiatorProcess(RelatedFileObject);
          if( InitiatorProcess != Object )
          {
            v11 = -1073741811;
            ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
          }
        }
        if( v11 >= 0 )
        {
          *((_QWORD *)TypeExt + 1) = Object;
          if( (v7 & 1) != 0 )
          {
            FileObject->Flags |= 0x20000000u;
            IopSetFileObjectExtensionFlag(FileObject, 8ui64, 0);
          }
        }
      }
    }
  }
  return v11;
}

Referenced by: