ObInheritObjectHandle
__int64 __fastcall ObInheritObjectHandle(ULONG_PTR a1, __int64 a2, __int64 a3, __int64 a4){
unsigned __int64 v6;
int v9;
UINT64 v11;
int v12[8];
UINT64 TargetPid;
_OBJECT_TYPE *ObjectType;
int v15;
v6 = (*(__int64 *)a4 >> 16) & 0xFFFFFFFFFFFFFFF0ui64;
ObpIncrPointerCount((volatile INT64 *)v6);
v15 = *(_DWORD *)(a4 + 8) & 0x1FFFFFF;
_InterlockedExchangeAdd64((volatile signed __int64 *)a4, 1ui64);
_InterlockedOr(v12, 0);
if( *(_QWORD *)(a3 + 48) )
ExfUnblockPushLock((_EX_PUSH_LOCK *)(a3 + 48), 0i64);
v9 = ObpIncrementHandleCountEx(3, (__int64)&v15, a1, v6 + 48, 0, 0, 0i64);
if( v9 < 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)(v6 + 48));
}
else if( (*(_BYTE *)(&PerfGlobalGroupMask + 2) & 0x40) != 0 )
{
v11 = *(unsigned int *)(a1 + 1344);
ObjectType = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(v6 + 24) ^ (unsigned __int64)BYTE1(v6)];
LODWORD(TargetPid) = *(_DWORD *)(a1 + 1088);
EtwTraceDuplicateHandle((VOID *)a2, (VOID *)a2, (VOID *)(v6 + 48), v11, TargetPid, ObjectType);
}
return(unsigned int)v9;
}Referenced by:
ExpDuplicateSingleHandle