ExpWin32CloseProcedure

VOID __stdcall ExpWin32CloseProcedure(
        _EPROCESS *Process,
        PVOID Object,
        UINT64 ProcessHandleCount,
        UINT64 SystemHandleCount){
  unsigned __int64 v4; 
  POBJECT_TYPE *v5; 
  INT64 v6; 
  __int64 v7[2]; 
  int v8; 
  int v9; 
  UINT64 v10; 
  LODWORD(v10) = *(_DWORD *)Object;
  v4 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  v7[0] = (__int64)Process;
  v7[1] = (__int64)Object;
  v8 = ProcessHandleCount;
  v9 = SystemHandleCount;
  v5 = (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v4];
  if( v5 == (POBJECT_TYPE *)ExActivationObjectType )
  {
    v6 = 39i64;
  }
  else if( v5 == (POBJECT_TYPE *)ExCoreMessagingObjectType )
  {
    v6 = 35i64;
  }
  else if( v5 == (POBJECT_TYPE *)ExRawInputManagerObjectType )
  {
    v6 = 29i64;
  }
  else if( v5 == (POBJECT_TYPE *)ExCompositionObjectType )
  {
    v6 = 20i64;
  }
  else if( v5 == ExDesktopObjectType )
  {
    v6 = 10i64;
  }
  else
  {
    if( v5 != (POBJECT_TYPE *)ExWindowStationObjectType )
      return;
    v6 = 13i64;
  }
  PsInvokeWin32Callout(v6, v7, 1i64, &v10);
}

Referenced by: