OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO
_HANDLE_REVOCATION_INFO *__stdcall OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO(_OBJECT_HEADER *ObjectHeader){
_HANDLE_REVOCATION_INFO **v1;
_HANDLE_REVOCATION_INFO *result;
if( (ObjectHeader->InfoMask & 0x40) == 0 )
return 0i64;
v1 = (_HANDLE_REVOCATION_INFO **)((char *)ObjectHeader
- *((unsigned __int8 *)&dword_140C25D60 + (ObjectHeader->InfoMask & 0x7F)));
result = *v1;
if( !(*v1)->AllowHandleRevocation )
return 0i64;
return result;
}Referenced by:
ObHandleRevocationBlockAddObject
ObpCreateHandle
ObpProcessRemoveObjectQueue