ObSetHandleAttributes

NTSTATUS __stdcall ObSetHandleAttributes(VOID *Handle, _OBJECT_HANDLE_FLAG_INFORMATION *HandleFlags, INT8 PreviousMode){
  unsigned __int64 v4; 
  char v5; 
  char v6; 
  _EPROCESS *Process; 
  VOID *v8; 
  INT64 v9; 
  _HANDLE_TABLE *ObjectTable; 
  _ETHREAD *CurrentThread; 
  _HANDLE_TABLE_ENTRY *v12; 
  _HANDLE_TABLE_ENTRY *v13; 
  unsigned __int64 v14; 
  unsigned int v15; 
  UINT64 v16; 
  NTSTATUS v17; 
  int v19[8]; 
  _KAPC_STATE decode_size; 

  memset(&decode_size, 0, sizeof(decode_size));
  v4 = (unsigned __int64)Handle;
  v5 = 0;
  v6 = 0;
  Process = KeGetCurrentThread()->ApcState.Process;
  if( ObpIsKernelHandle(Handle, PreviousMode) )
  {
    v4 ^= 0xFFFFFFFF80000000ui64;
    ObjectTable = HandleTable;
    if( Process != PsInitialSystemProcess )
    {
      KiStackAttachProcess(PsInitialSystemProcess, 0i64, &decode_size);
      v5 = 1;
    }
  }
  else if( KeGetCurrentThread()->ApcStateIndex == 1 )
  {
    ObjectTable = ObReferenceProcessHandleTable(Process);
    if( !ObjectTable )
      return -1073741816;
    v6 = 1;
  }
  else
  {
    ObjectTable = KeGetCurrentThread()->ApcState.Process->ObjectTable;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v12 = ExMapHandleToPointer(
          ObjectTable,
          (VOID *)v4,
          v8,
          v9,
          decode_size.ApcListHead[0].Flink,
          (INT64)decode_size.ApcListHead[0].Blink,
          decode_size.ApcListHead[1].Flink);
  v13 = v12;
  if( v12 )
  {
    v14 = (v12->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64;
    if( !HandleFlags->Inherit
      || (*(_DWORD *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(v14 + 24) ^ (unsigned __int64)BYTE1(v14)]
                    + 72) & 2) == 0 )
    {
      v15 = HandleFlags->Inherit != 0 ? 2 : 0;
      v16 = v15 | 1;
      if( !HandleFlags->ProtectFromClose )
        v16 = v15;
      ExSetHandleAttributes(v13, v16, 3ui64);
    }
    _InterlockedExchangeAdd64(&v13->VolatileLowValue, 1ui64);
    _InterlockedOr(v19, 0);
    if( ObjectTable->HandleContentionEvent._bf_0 )
      ExfUnblockPushLock(&ObjectTable->HandleContentionEvent._bf_0, 0i64);
    v17 = 0;
  }
  else
  {
    v17 = -1073741790;
  }
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  if( v5 )
    KiUnstackDetachProcess(&decode_size, 0i64);
  if( v6 )
    ExReleaseRundownProtection(&Process->RundownProtect);
  return v17;
}

Referenced by: