ObpRemoveObjectRoutine
VOID __stdcall ObpRemoveObjectRoutine(_OBJECT_HEADER *ObjectHeader, UINT8 CalledOnWorkerThread){
__int64 v4;
void(__fastcall *v5)(_QUAD *);
void *SecurityDescriptor;
v4 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ ObjectHeader->TypeIndex ^ (unsigned __int64)BYTE1(ObjectHeader)];
if( v4 == *(&stru_140C23628 + 837) )
KeBugCheckEx(0xF4u, (PVOID)v4, &ObjectHeader->Body, 0i64, 0i64);
SecurityDescriptor = ObjectHeader->SecurityDescriptor;
if( SecurityDescriptor )
(*(void(__fastcall **)(_QUAD *, __int64, _QWORD, _QWORD, _QWORD, void **, _DWORD, _QWORD, _BYTE))(v4 + 152))(
&ObjectHeader->Body,
2i64,
0i64,
0i64,
0i64,
&SecurityDescriptor,
0,
0i64,
0);
v5 = *(void(__fastcall **)(_QUAD *))(v4 + 136);
if( v5 )
{
if( !CalledOnWorkerThread )
{
ObjectHeader->Flags |= 0x80u;
v5 = *(void(__fastcall **)(_QUAD *))(v4 + 136);
}
v5(&ObjectHeader->Body);
}
ObpFreeObject(ObjectHeader);
}Referenced by:
ObfDereferenceObjectWithTag
ObpProcessRemoveObjectQueue