ObpIsKernelHandle

UINT8 __stdcall ObpIsKernelHandle(PVOID Handle, INT8 AccessMode){
  return !AccessMode
      && ((unsigned __int64)Handle & 0xFFFFFFFF80000000ui64) == 0xFFFFFFFF80000000ui64
      && (unsigned __int64)Handle <= 0xFFFFFFFFFFFFFFFDui64;
}

Referenced by:

NtClose
ObCloseHandle
ObIsKernelHandle
ObQueryObjectAuditingByHandle
ObSetHandleAttributes
ObWaitForMultipleObjects
ObpCloseHandle
SeAdtRegistryValueChangedAuditAlarm
SeAuditHandleDuplication
SeOperationAuditAlarm
SepAdtCloseObjectAuditAlarm
SepAdtDeleteObjectAuditAlarm
SepAdtOpenObjectAuditAlarm
SepAdtPrivilegeObjectAuditAlarm
SepAdtSecurityDescriptorChangedAuditAlarm
SepAdtStagingEvent