IoRevokeHandlesForProcess

NTSTATUS __stdcall IoRevokeHandlesForProcess(_UNICODE_STRING *TargetDevicePath, _EPROCESS *Process){
  _HANDLE_TABLE *v5; 
  NTSTATUS v6; 
  _LIST_ENTRY *DevicePDO; 
  _LIST_ENTRY *v8; 
  UINT64 v9; 
  _DEVICE_OBJECT *DeviceObject[2]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 ParseContext[14]; 
  PVOID Handle; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  if( !PsIsProcessAppContainer(Process) )
    return 0;
  v5 = ObReferenceProcessHandleTable(Process);
  if( !v5 )
    return -1073741811;
  memset(ParseContext, 0i64, 0xD8u);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Length = 48;
  memset(&ParseContext[10], 0, 32);
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = TargetDevicePath;
  LOWORD(ParseContext[10]) = 40;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(ParseContext[0]) = 14155784;
  LODWORD(ParseContext[2]) = 1;
  *(_QWORD *)&ParseContext[12] = 1i64;
  *(_QWORD *)&ParseContext[12] = PsGetCurrentSilo();
  LODWORD(v9) = 0;
  v6 = ObOpenObjectByNameEx(
         &ObjectAttributes,
         (_OBJECT_TYPE *)IoFileObjectType,
         0,
         0i64,
         v9,
         ParseContext,
         *(_EJOB **)&ParseContext[12],
         &Handle);
  if( LODWORD(ParseContext[2]) == -1096154543 )
  {
    v6 = ParseContext[1];
    if( SLODWORD(ParseContext[1]) >= 0 )
    {
      DeviceObject[0] = *((_DEVICE_OBJECT **)&ParseContext[2] + 1);
      DeviceObject[1] = (_DEVICE_OBJECT *)Process;
      ExEnumHandleTable(
        v5,
        (__int64(__fastcall *)(_HANDLE_TABLE *, _HANDLE_TABLE_ENTRY *, _EXHANDLE, __int64))IopCheckHandleForRevocation,
        (__int64)DeviceObject,
        0i64);
      DevicePDO = (_LIST_ENTRY *)IopGetDevicePDO(DeviceObject[0]);
      v8 = DevicePDO;
      if( DevicePDO )
      {
        PnpDisableUserModeNotifications(DevicePDO, (__int64)Process);
        ObfDereferenceObjectWithTag(v8, 0x746C6644ui64);
      }
      ObfDereferenceObjectWithTag(DeviceObject[0], 0x746C6644ui64);
    }
  }
  ObDereferenceProcessHandleTable(Process);
  return v6;
}

Referenced by: