ObAuditInheritedHandleProcedure

VOID __stdcall ObAuditInheritedHandleProcedure(VOID **a1){
  volatile signed __int64 *v1; 
  VOID *v2; 
  _EPROCESS **v3; 
  _EPROCESS **v4; 
  VOID *v5; 
  __int64 v6; 
  INT64 *v7; 
  int v8[10]; 

  v4 = v3;
  v5 = v2;
  v6 = ((__int64)*(unsigned int *)v1 >> 17) & 4;
  _InterlockedExchangeAdd64(v1, 1ui64);
  v7 = (INT64 *)(a1 + 6);
  _InterlockedOr(v8, 0);
  if( *v7 )
    ExfUnblockPushLock(v7, 0i64);
  if( (_DWORD)v6 )
    SeAuditHandleDuplication(v5, v5, v4[1], *v4);
}

Referenced by:

No references.