ObQueryObjectAuditingByHandle

NTSTATUS __stdcall ObQueryObjectAuditingByHandle(VOID *Handle, UINT8 *GenerateOnClose){
  _ETHREAD *CurrentThread; 
  unsigned __int64 v4; 
  char v5; 
  _EPROCESS *Process; 
  VOID *v7; 
  INT64 v8; 
  _HANDLE_TABLE *ObjectTable; 
  _HANDLE_TABLE_ENTRY *v10; 
  __int64 v11; 
  NTSTATUS v12; 
  int v14[8]; 
  const VOID *v15; 
  INT64 v16; 
  PVOID v17; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = (unsigned __int64)Handle;
  v5 = 0;
  Process = CurrentThread->Tcb.ApcState.Process;
  if( ObpIsKernelHandle(Handle, CurrentThread->Tcb.PreviousMode) )
  {
    ObjectTable = HandleTable;
    v4 ^= 0xFFFFFFFF80000000ui64;
  }
  else if( KeGetCurrentThread()->ApcStateIndex == 1 )
  {
    ObjectTable = ObReferenceProcessHandleTable(Process);
    if( !ObjectTable )
      return -1073741816;
    v5 = 1;
  }
  else
  {
    ObjectTable = Process->ObjectTable;
  }
  --CurrentThread->Tcb.KernelApcDisable;
  v10 = ExMapHandleToPointer(ObjectTable, (VOID *)v4, v7, v8, v15, v16, v17);
  if( v10 )
  {
    v11 = v10->LowValue >> 17;
    _InterlockedExchangeAdd64(&v10->VolatileLowValue, 1ui64);
    _InterlockedOr(v14, 0);
    if( ObjectTable->HandleContentionEvent._bf_0 )
      ExfUnblockPushLock(&ObjectTable->HandleContentionEvent._bf_0, 0i64);
    *GenerateOnClose = (v11 & 4) != 0;
    v12 = 0;
  }
  else
  {
    v12 = -1073741816;
  }
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  if( v5 )
    ExReleaseRundownProtection(&Process->RundownProtect);
  return v12;
}

Referenced by: