PsReferenceProcessFilePointer

__int64 __fastcall PsReferenceProcessFilePointer(struct _EX_RUNDOWN_REF *a1, unsigned __int64 *a2){
  struct _EX_RUNDOWN_REF *v2; 
  _SECTION *Count; 
  _CONTROL_AREA *v6; 
  _FILE_OBJECT *v7; 
  __int64 result; 
  v2 = a1 + 139;
  if( ExAcquireRundownProtection(a1 + 139) )
  {
    Count = (_SECTION *)a1[163].Count;
    if( Count )
    {
      v6 = MiSectionControlArea(Count);
      v7 = MiReferenceControlAreaFile(v6);
      ExReleaseRundownProtection(v2);
      result = 0i64;
      *a2 = (unsigned __int64)v7;
      return result;
    }
    ExReleaseRundownProtection(v2);
  }
  return 3221225473i64;
}

Referenced by: