ObOpenObjectByPointer

NTSTATUS __stdcall ObOpenObjectByPointer(
        PVOID Object,
        ULONG HandleAttributes,
        PACCESS_STATE PassedAccessState,
        ACCESS_MASK DesiredAccess,
        POBJECT_TYPE ObjectType,
        KPROCESSOR_MODE AccessMode,
        PHANDLE Handle){
  void *v10; 
  POBJECT_TYPE v11; 
  NTSTATUS v12; 
  _ETHREAD *CurrentThread; 
  _EX_FAST_REF *v14; 
  _EX_FAST_REF *v15; 
  _QWORD *v16; 
  int v17; 
  NTSTATUS v18; 
  NTSTATUS v19; 
  INT64 *v20; 
  INT64 *Lock; 
  _ETHREAD *v23; 
  _ETHREAD *v24; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int64 v26[20]; 
  __int64 result[28]; 
  memset((INT64)result, 0i64);
  memset((INT64)v26, 0i64);
  v10 = 0i64;
  v11 = ObjectType;
  *Handle = 0i64;
  v12 = ObReferenceObjectByPointerWithTag(Object, 0, ObjectType, AccessMode, 0x6E48624Fu);
  if( v12 >= 0 )
  {
    if( !ObjectType )
      v11 = (POBJECT_TYPE)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
    if( (HandleAttributes & v11->TypeInfo.InvalidAttributes) != 0
      || (*((char *)Object - 21) & 1) != 0 && *((_QWORD *)Object - 2) )
    {
      ++ObpInvalidOpenByPointer;
      ObfDereferenceObjectWithTag(Object, 0x6E48624Fui64);
      return -1073741811;
    }
    else
    {
      if( !PassedAccessState )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        *(_QWORD *)&SubjectContext.ImpersonationLevel = 0i64;
        v14 = (_EX_FAST_REF *)*((_QWORD *)CurrentThread + 23);
        SubjectContext.ProcessAuditId = v14[136].Object;
        if( CurrentThread && (*((_DWORD *)CurrentThread + 324) & 8) != 0 )
        {
          v23 = (_ETHREAD *)KeGetCurrentThread();
          --*((_WORD *)v23 + 242);
          Lock = (INT64 *)((char *)CurrentThread + 1280);
          ExAcquirePushLockSharedEx((UINT64)CurrentThread + 1280, 0i64);
          if( (*((_DWORD *)CurrentThread + 324) & 8) != 0 )
          {
            v10 = (void *)(*((_QWORD *)CurrentThread + 149) & 0xFFFFFFFFFFFFFFF8ui64);
            ObfReferenceObject(v10);
            SubjectContext.ImpersonationLevel = *((_DWORD *)CurrentThread + 298) & 3;
          }
          if( _InterlockedCompareExchange64(Lock, 0i64, 17i64) != 17 )
            ExfReleasePushLockShared(Lock);
          KeAbPostRelease(Lock);
          KeLeaveCriticalRegionThread((__int64)v23);
        }
        SubjectContext.ClientToken = v10;
        v15 = v14 + 151;
        v16 = ObFastReferenceObject((INT64 *)&v14[151]);
        if( !v16 )
        {
          v24 = (_ETHREAD *)KeGetCurrentThread();
          --*((_WORD *)v24 + 242);
          v20 = (INT64 *)&v14[135];
          ExAcquirePushLockSharedEx((UINT64)v20, 0i64);
          v16 = (_QWORD *)ObFastReferenceObjectLocked(v15);
          if( _InterlockedCompareExchange64(v20, 0i64, 17i64) != 17 )
            ExfReleasePushLockShared(v20);
          KeAbPostRelease(v20);
          KeLeaveCriticalRegionThread((__int64)v24);
        }
        SubjectContext.PrimaryToken = v16;
        if( SeTokenLeakTracking )
        {
          if( v16 )
          {
            _InterlockedIncrement((volatile signed __int32 *)(v16[143] + 284i64));
            if( v16 == (_QWORD *)SepTokenLeakToken )
              __debugbreak();
          }
          if( SubjectContext.ClientToken )
          {
            _InterlockedIncrement((volatile signed __int32 *)(*((_QWORD *)SubjectContext.ClientToken + 143) + 284i64));
            if( SubjectContext.ClientToken == (void *)SepTokenLeakToken )
              __debugbreak();
          }
        }
        SepCreateAccessStateFromSubjectContext(
          &SubjectContext,
          (_ACCESS_STATE *)v26,
          (_AUX_ACCESS_DATA *)result,
          DesiredAccess,
          &v11->TypeInfo.GenericMapping);
        v18 = v17;
        if( v17 < 0 )
        {
          ObfDereferenceObjectWithTag(Object, 0x6E48624Fui64);
          return v18;
        }
        PassedAccessState = (PACCESS_STATE)v26;
      }
      v19 = ObpCreateHandle(
              1,
              (char *)Object,
              0,
              PassedAccessState,
              0,
              HandleAttributes,
              AccessMode,
              0i64,
              0,
              0i64,
              (__int64 *)Handle);
      if( v19 < 0 )
        ObfDereferenceObjectWithTag(Object, 0x6E48624Fui64);
      if( PassedAccessState == (PACCESS_STATE)v26 )
      {
        SepDeleteAccessState(PassedAccessState);
        SeReleaseSubjectContext((_SECURITY_SUBJECT_CONTEXT *)PassedAccessState + 1);
      }
      return v19;
    }
  }
  return v12;
}

Referenced by: