ObpAuditObjectAccess

UINT8 __stdcall ObpAuditObjectAccess(
        _HANDLE_TABLE *HandleTable,
        VOID *Handle,
        _HANDLE_TABLE_ENTRY *HandleTableEntry,
        _OBJECT_HEADER *ObjectHeader,
        UINT64 DesiredAccess){
  _HANDLE_TABLE_ENTRY_INFO *HandleExtraInfo; 
  _ETHREAD *CurrentThread; 
  UINT8 v11; 
  unsigned int v12; 
  int v13; 
  VOID *v14; 
  _UNICODE_STRING *v15; 
  unsigned __int64 v16; 
  int v18[8]; 
  UINT64 AuditMask; 
  VOID *v20; 
  VOID *SecurityDescriptor; 

  if( !HandleTable->ExtraInfoPages )
    return 1;
  HandleExtraInfo = ExpGetHandleExtraInfo(HandleTable, Handle);
  if( !HandleExtraInfo )
    return 1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  if( ExLockHandleTableEntry(HandleTable, HandleTableEntry) )
  {
    _m_prefetchw(HandleExtraInfo);
    v12 = HandleExtraInfo->AuditMask;
    if( ObjectHeader == (_OBJECT_HEADER *)((HandleTableEntry->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64) )
    {
      v13 = DesiredAccess & v12;
      if( ((unsigned int)DesiredAccess & v12) != 0 )
      {
        v14 = 0i64;
        HandleExtraInfo->AuditMask = v12 & ~(_DWORD)DesiredAccess;
        if( (ObjectHeader->InfoMask & 0x20) != 0 )
          v15 = (_UNICODE_STRING *)((char *)ObjectHeader
                                  - *((unsigned __int8 *)&dword_140C25D60 + (ObjectHeader->InfoMask & 0x3F)));
        else
          v15 = 0i64;
        if( v15 )
          v14 = *(VOID **)&v15->Length;
        SecurityDescriptor = v14;
        v16 = ObjectHeader->TypeIndex ^ (unsigned __int64)BYTE1(ObjectHeader);
        LODWORD(AuditMask) = v13;
        SeOperationAuditAlarm(
          v15,
          &ObjectHeader->Body,
          Handle,
          (_UNICODE_STRING *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v16] + 16),
          AuditMask,
          v20,
          v14);
      }
      v11 = 1;
    }
    else
    {
      v11 = 0;
    }
    _InterlockedExchangeAdd64(&HandleTableEntry->VolatileLowValue, 1ui64);
    _InterlockedOr(v18, 0);
    if( HandleTable->HandleContentionEvent._bf_0 )
      ExfUnblockPushLock(&HandleTable->HandleContentionEvent._bf_0, 0i64);
  }
  else
  {
    v11 = 0;
  }
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v11;
}

Referenced by: