IopCheckHandleForRevocation

char __fastcall IopCheckHandleForRevocation(__int64 a1, volatile signed __int64 *a2, __int64 a3, _QWORD *a4){
  int v7[10]; 
  if( (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(((*(__int64 *)a2 >> 16) & 0xFFFFFFFFFFFFFFF0ui64)
                                                                                             + 0x18) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)(WORD1(*a2) & 0xFFF0) >> 8)] == IoFileObjectType
    && *(_QWORD *)(((*(__int64 *)a2 >> 16) & 0xFFFFFFFFFFFFFFF0ui64) + 0x38) == *a4 )
  {
    IopRevokeFileObjectForProcess(((*(__int64 *)a2 >> 16) & 0xFFFFFFFFFFFFFFF0ui64) + 48, a4[1]);
  }
  _InterlockedExchangeAdd64(a2, 1ui64);
  _InterlockedOr(v7, 0);
  if( *(_QWORD *)(a1 + 48) )
    ExpUnblockPushLock((_EX_PUSH_LOCK *)(a1 + 48), 0i64, 0i64);
  return 0;
}

Referenced by: