ObFastReplaceObject

VOID *__stdcall ObFastReplaceObject(_EX_FAST_REF *FastRef, VOID *Object, UINT64 a3){
  __int64 v5; 
  volatile signed __int64 *v6; 
  unsigned int v7; 
  PVOID *v8; 
  void *BugCheckParameter4; 

  if( Object )
    ObReferenceObjectExWithTag(Object, 0xFui64, a3);
  v5 = _InterlockedExchange64(
         (volatile __int64 *)FastRef,
         ((unsigned __int64)Object | 0xF) & -(__int64)(Object != 0i64));
  v6 = (volatile signed __int64 *)(v5 & 0xFFFFFFFFFFFFFFF0ui64);
  if( (v5 & 0xFFFFFFFFFFFFFFF0ui64) != 0 )
  {
    v7 = v5 & 0xF;
    if( v7 )
    {
      v8 = (PVOID *)(v6 - 6);
      ObpTraceObjectDereferenceIfActive((_OBJECT_HEADER *)(v6 - 6), v7, 0x746C6644ui64);
      BugCheckParameter4 = (void *)(_InterlockedExchangeAdd64(v6 - 6, -v7) - v7);
      if( (__int64)BugCheckParameter4 <= 0 )
      {
        if( v8[1] )
          KeBugCheckEx(
            0x18u,
            (PVOID)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *((unsigned __int8 *)v8 + 24) ^ (unsigned __int64)BYTE1(v8)],
            (PVOID)v6,
            (PVOID)6,
            v8[1]);
        if( (__int64)BugCheckParameter4 < 0 )
          KeBugCheckEx(0x18u, 0i64, (PVOID)v6, (PVOID)5, BugCheckParameter4);
        ObpDeferObjectDeletion((_OBJECT_HEADER *)(v6 - 6));
      }
    }
  }
  return(VOID *)v6;
}

Referenced by: