ExpWin32OpenProcedure

INT64 __fastcall ExpWin32OpenProcedure(
        _OB_OPEN_REASON OpenReason,
        CHAR AccessMode,
        _EPROCESS *Process,
        VOID *Object,
        UINT64 *GrantedAccess,
        UINT64 HandleCount){
  int v6; 
  unsigned int v7; 
  unsigned __int64 v8; 
  POBJECT_TYPE *v9; 
  int v10; 
  INT64 v11; 
  int v13[2]; 
  _EPROCESS *v14; 
  VOID *v15; 
  int v16; 
  int v17; 
  UINT64 v18; 
  v6 = *(_DWORD *)Object;
  v13[1] = 0;
  v7 = -1073741823;
  LODWORD(v18) = v6;
  v8 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  v13[0] = OpenReason;
  v14 = Process;
  v15 = Object;
  v9 = (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v8];
  v10 = *(_DWORD *)GrantedAccess;
  v17 = HandleCount;
  v16 = v10;
  if( v9 == (POBJECT_TYPE *)ExActivationObjectType )
  {
    v11 = 37i64;
    return(unsigned int)PsInvokeWin32Callout(v11, v13, 1i64, &v18);
  }
  if( v9 == (POBJECT_TYPE *)ExCoreMessagingObjectType )
  {
    v11 = 33i64;
    return(unsigned int)PsInvokeWin32Callout(v11, v13, 1i64, &v18);
  }
  if( v9 == (POBJECT_TYPE *)ExRawInputManagerObjectType )
  {
    v11 = 27i64;
    return(unsigned int)PsInvokeWin32Callout(v11, v13, 1i64, &v18);
  }
  if( v9 == (POBJECT_TYPE *)ExCompositionObjectType )
  {
    v11 = 18i64;
    return(unsigned int)PsInvokeWin32Callout(v11, v13, 1i64, &v18);
  }
  if( v9 == ExDesktopObjectType )
  {
    v11 = 8i64;
    return(unsigned int)PsInvokeWin32Callout(v11, v13, 1i64, &v18);
  }
  if( v9 == (POBJECT_TYPE *)ExWindowStationObjectType )
  {
    v11 = 16i64;
    return(unsigned int)PsInvokeWin32Callout(v11, v13, 1i64, &v18);
  }
  return v7;
}

Referenced by: