ObSetHandleAttributes

__int64 __fastcall ObSetHandleAttributes(unsigned __int64 a1, _BYTE *a2, char a3){
  unsigned __int64 v4; 
  char v5; 
  char v6; 
  __int64 v7; 
  void *v8; 
  INT64 v9; 
  _HANDLE_TABLE *v10; 
  _ETHREAD *CurrentThread; 
  _HANDLE_TABLE_ENTRY *v12; 
  volatile signed __int64 *p_VolatileLowValue; 
  unsigned __int64 v14; 
  int v15; 
  unsigned int v16; 
  int v18[8]; 
  _KAPC_STATE decode_size; 
  memset(&decode_size, 0, sizeof(decode_size));
  v4 = a1;
  v5 = 0;
  v6 = 0;
  v7 = *((_QWORD *)KeGetCurrentThread() + 23);
  if( ObpIsKernelHandle((PVOID)a1, a3) )
  {
    v4 ^= 0xFFFFFFFF80000000ui64;
    v10 = (_HANDLE_TABLE *)ObpKernelHandleTable;
    if( (PEPROCESS)v7 != PsInitialSystemProcess )
    {
      KiStackAttachProcess(PsInitialSystemProcess, 0i64, &decode_size);
      v5 = 1;
    }
  }
  else if( *((_BYTE *)KeGetCurrentThread() + 586) == 1 )
  {
    v10 = (_HANDLE_TABLE *)ObReferenceProcessHandleTable((struct _EX_RUNDOWN_REF *)v7);
    if( !v10 )
      return 3221225480i64;
    v6 = 1;
  }
  else
  {
    v10 = *(_HANDLE_TABLE **)(*((_QWORD *)KeGetCurrentThread() + 23) + 1392i64);
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v12 = ExMapHandleToPointer(
          v10,
          (VOID *)v4,
          v8,
          v9,
          (INT64)decode_size.ApcListHead[0].Flink,
          (INT64)decode_size.ApcListHead[0].Blink,
          decode_size.ApcListHead[1].Flink);
  p_VolatileLowValue = &v12->VolatileLowValue;
  if( v12 )
  {
    v14 = (v12->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64;
    if( !*a2
      || (*(_DWORD *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(v14 + 24) ^ (unsigned __int64)BYTE1(v14)]
                    + 72) & 2) == 0 )
    {
      v15 = (*a2 != 0 ? 2 : 0) | 1;
      if( !a2[1] )
        v15 = *a2 != 0 ? 2 : 0;
      ExSetHandleAttributes((__int64)p_VolatileLowValue, v15, 3);
    }
    _InterlockedExchangeAdd64(p_VolatileLowValue, 1ui64);
    _InterlockedOr(v18, 0);
    if( v10->HandleContentionEvent.Value )
      ExfUnblockPushLock(&v10->HandleContentionEvent, 0i64);
    v16 = 0;
  }
  else
  {
    v16 = -1073741790;
  }
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  if( v5 )
    KiUnstackDetachProcess(&decode_size, 0i64);
  if( v6 )
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)(v7 + 1112));
  return v16;
}

Referenced by: