ObReferenceFileObjectForWrite

NTSTATUS __stdcall ObReferenceFileObjectForWrite(
        PVOID Handle,
        INT8 AccessMode,
        PVOID *FileObject,
        OBJECT_HANDLE_INFORMATION *HandleInformation){
  _ETHREAD *CurrentThread; 
  unsigned __int64 v5; 
  ULONG_PTR v7; 
  __int64 v8; 
  _HANDLE_TABLE *v9; 
  _HANDLE_TABLE_ENTRY *v10; 
  _HANDLE_TABLE_ENTRY *v11; 
  INT64 LowValue; 
  signed __int64 HighValue; 
  INT64 v14; 
  unsigned __int128 v15; 
  unsigned __int8 v16; 
  __int64 v17; 
  bool v18; 
  struct _DMA_ADAPTER *v19; 
  unsigned int v20; 
  int v21; 
  __int64 v22; 
  int v23; 
  unsigned __int64 v24; 
  int v26; 
  NTSTATUS v27; 
  int v28; 
  int v29[8]; 
  INT64 v30; 
  INT64 CurrentValue[2]; 
  ULONG_PTR v32; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = 0i64;
  v7 = (ULONG_PTR)Handle;
  *(_OWORD *)CurrentValue = 0i64;
  if( (int)Handle < 0 )
  {
    if( !AccessMode && Handle != (PVOID)-1i64 && Handle != (PVOID)-2i64 )
    {
      v9 = (_HANDLE_TABLE *)ObpKernelHandleTable;
      v7 = (unsigned __int64)Handle ^ 0xFFFFFFFF80000000ui64;
      v32 = ObpKernelHandleTable;
      goto LABEL_3;
    }
  }
  else
  {
    v8 = *((_QWORD *)CurrentThread + 23);
    v9 = *(_HANDLE_TABLE **)(v8 + 1392);
    v32 = (ULONG_PTR)v9;
    if( (*(_DWORD *)(v8 + 1124) & 0x4000000) != 0 )
    {
LABEL_3:
      --*((_WORD *)CurrentThread + 242);
      if( (v7 & 0x3FC) != 0 && (v10 = ExpLookupHandleTableEntry(v9, (_EXHANDLE)v7), (v11 = v10) != 0i64) )
      {
        _m_prefetchw(v10);
        LowValue = v10->LowValue;
        HighValue = v11->HighValue;
        CurrentValue[1] = HighValue;
        CurrentValue[0] = LowValue;
        v14 = LowValue;
        while( (v14 & 0x1FFFE) != 0 )
        {
          if( (v14 & 1) != 0 )
          {
            *(_QWORD *)&v15 = v14;
            *((_QWORD *)&v15 + 1) = HighValue;
            v16 = _InterlockedCompareExchange128(&v11->VolatileLowValue, HighValue, v14 - 2, (signed __int64 *)&v15);
            HighValue = v15 >> 64;
            v17 = v15;
            v14 = v15;
            *(_OWORD *)CurrentValue = v15;
            if( v16 )
            {
              if( (unsigned __int16)((unsigned __int64)v17 >> 1) != 16 )
              {
                v5 = (v17 >> 16) & 0xFFFFFFFFFFFFFFF0ui64;
                goto LABEL_10;
              }
              CurrentValue[0] = v17 ^ ((unsigned int)v17 ^ (2 * (unsigned int)((unsigned __int64)v17 >> 1) - 2)) & 0x1FFFE;
              v5 = (CurrentValue[0] >> 16) & 0xFFFFFFFFFFFFFFF0ui64;
              ObpIncrPointerCountEx((volatile INT64 *)v5, 32752i64);
              v28 = ExFastReplenishHandleTableEntry(&v11->VolatileLowValue, (unsigned __int64 *)CurrentValue, 32752);
              if( v28 )
                _InterlockedExchangeAdd64((volatile signed __int64 *)v5, -v28);
LABEL_30:
              LODWORD(HighValue) = CurrentValue[1];
              v14 = CurrentValue[0];
              goto LABEL_10;
            }
            v9 = (_HANDLE_TABLE *)v32;
          }
          else
          {
            ExpBlockOnLockedHandleEntry(v9, v11, v14);
            _m_prefetchw(v11);
            HighValue = v11->HighValue;
            CurrentValue[0] = v11->LowValue;
            v14 = CurrentValue[0];
            CurrentValue[1] = HighValue;
          }
        }
        if( ExLockHandleTableEntry((__int64)v9, &v11->LowValue) )
        {
          v5 = (v11->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64;
          *(_HANDLE_TABLE_ENTRY *)CurrentValue = *v11;
          v26 = ExSlowReplenishHandleTableEntry((unsigned __int64 *)v11);
          ObpIncrPointerCountEx((volatile INT64 *)v5, (unsigned int)(v26 + 1));
          _InterlockedExchangeAdd64(&v11->VolatileLowValue, 1ui64);
          _InterlockedOr(v29, 0);
          if( v9->HandleContentionEvent.Value )
          {
            ExfUnblockPushLock(&v9->HandleContentionEvent, 0i64);
            LODWORD(HighValue) = CurrentValue[1];
            v14 = CurrentValue[0];
            goto LABEL_10;
          }
          goto LABEL_30;
        }
      }
      else
      {
        LODWORD(HighValue) = CurrentValue[1];
        v14 = CurrentValue[0];
      }
      if( v7 )
      {
        ExHandleLogBadReference((ULONG_PTR)v9, v7, *((_BYTE *)KeGetCurrentThread() + 562));
        LODWORD(HighValue) = CurrentValue[1];
        v14 = CurrentValue[0];
      }
      v11 = 0i64;
LABEL_10:
      v18 = (*((_WORD *)CurrentThread + 242))++ == 0xFFFF;
      if( v18
        && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152)
        && !*((_WORD *)CurrentThread + 243) )
      {
        KiCheckForKernelApcDelivery();
      }
      if( !v11 )
      {
        v27 = -1073741816;
LABEL_36:
        *FileObject = 0i64;
        return v27;
      }
      if( ObpTraceFlags )
        ObpPushStackInfo(v5, 1, 1i64, 1953261124i64);
      v19 = (struct _DMA_ADAPTER *)(v5 + 48);
      if( (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(v5 + 24) ^ (unsigned __int64)BYTE1(v5)] == IoFileObjectType )
      {
        v20 = HighValue & 0x1FFFFFF;
        v21 = ~(unsigned __int8)(*(_DWORD *)(v5 + 128) >> 5) & 4;
        HandleInformation->GrantedAccess = v20;
        v22 = (v14 >> 17) & 7;
        v23 = v21 | 2;
        HandleInformation->HandleAttributes = v22;
        if( (v20 & v23) != 0 )
        {
          if( !AccessMode )
            goto LABEL_22;
          if( (*(_BYTE *)(v5 + 26) & 0x40) == 0 )
            goto LABEL_22;
          v24 = v5 - *((unsigned __int8 *)ObpInfoMaskToOffset + (*(_BYTE *)(v5 + 26) & 0x7F));
          if( !*(_BYTE *)(*(_QWORD *)v24 + 24i64) )
            goto LABEL_22;
          if( *(_QWORD *)(*(_QWORD *)v24 + 16i64) != 1i64 )
          {
            LODWORD(v22) = HandleInformation->HandleAttributes;
LABEL_22:
            if( (v22 & 4) == 0
              || !AccessMode
              || (LODWORD(v30) = v23, ObpAuditObjectAccess(v32, (VOID *)v7, &v11->VolatileLowValue, (UINT8 *)v5, v30)) )
            {
              *FileObject = v19;
              return 0;
            }
            v27 = -1073741816;
            goto LABEL_53;
          }
          v27 = -1073700858;
        }
        else
        {
          v27 = -1073741790;
        }
      }
      else
      {
        v27 = -1073741788;
      }
LABEL_53:
      HalPutDmaAdapter(v19);
      goto LABEL_36;
    }
  }
  return -1073741816;
}

Referenced by: