ObpPreInterceptHandleCreate

NTSTATUS __stdcall ObpPreInterceptHandleCreate(
        PVOID Object,
        INT8 KernelHandle,
        INT64 *DesiredAccess,
        _LIST_ENTRY *ThreadCallbackListHead){
  unsigned __int64 v6; 
  int v8; 
  _OBJECT_TYPE *v9; 
  unsigned int RetainAccess; 
  int v11; 
  NTSTATUS result; 
  int v13[2]; 
  __int128 v14; 
  _OB_PRE_OPERATION_INFORMATION PreOperationInfo; 

  v6 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  PreOperationInfo.Flags = 0;
  v8 = *(_DWORD *)DesiredAccess;
  v14 = 0i64;
  v9 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v6];
  RetainAccess = v9->TypeInfo.RetainAccess;
  PreOperationInfo.Parameters = (POB_PRE_OPERATION_PARAMETERS)v13;
  v11 = v8 & RetainAccess;
  v13[1] = v8;
  v13[0] = v8;
  PreOperationInfo.Operation = 1;
  PreOperationInfo.Object = Object;
  PreOperationInfo.Flags = KernelHandle & 1;
  PreOperationInfo.CallContext = 0i64;
  v14 = 0i64;
  PreOperationInfo.ObjectType = v9;
  result = ObpCallPreOperationCallbacks(v9, &PreOperationInfo, ThreadCallbackListHead);
  if( result >= 0 && !KernelHandle )
    *(_DWORD *)DesiredAccess &= v11 | v13[0];
  return result;
}

Referenced by: