ObDereferenceSecurityDescriptor

VOID __stdcall ObDereferenceSecurityDescriptor(VOID *SecurityDescriptor, UINT64 Count){
  int v2; 
  volatile signed __int64 *v3; 
  signed __int64 v4; 
  __int64 v5; 
  signed __int64 v6; 
  signed __int64 v7; 
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *v9; 
  _EX_PUSH_LOCK *v10; 
  __int64 v11; 
  volatile signed __int64 *i; 

  v2 = Count;
  v3 = (volatile signed __int64 *)((char *)SecurityDescriptor - 32);
  _m_prefetchw((char *)SecurityDescriptor - 24);
  v4 = *((_QWORD *)SecurityDescriptor - 3);
  v5 = (unsigned int)Count;
  v6 = v4 - (unsigned int)Count;
  if( v6 <= 0 )
  {
LABEL_4:
    if( v6 )
      __fastfail(0xEu);
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v9 = (_EX_PUSH_LOCK *)((char *)&ObsSecurityDescriptorCache + 16 * (unsigned __int8)*((_DWORD *)v3 + 4));
    --CurrentThread->Tcb.KernelApcDisable;
    v10 = v9 + 1;
    ExAcquirePushLockExclusiveEx(v9, 0i64);
    v11 = _InterlockedExchangeAdd64(v3 + 1, -v2) - v5;
    if( v11 > 0 )
    {
      if( (_InterlockedExchangeAdd64(&v9->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v9);
      KeAbPostRelease(v9);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    }
    else
    {
      if( v11 )
        __fastfail(0xEu);
      for( i = (volatile signed __int64 *)v10->_bf_0; i != v3; i = (volatile signed __int64 *)*i )
        v10 = (_EX_PUSH_LOCK *)i;
      v10->_bf_0 = *(__int64 *)v3;
      if( (_InterlockedExchangeAdd64(&v9->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v9);
      KeAbPostRelease(v9);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
      ExFreePoolWithTag((PVOID)v3, 0x6353624Fu);
    }
  }
  else
  {
    while( 1 )
    {
      v7 = v4;
      v4 = _InterlockedCompareExchange64(v3 + 1, v6, v4);
      if( v7 == v4 )
        break;
      v6 = v4 - (unsigned int)Count;
      if( v6 <= 0 )
        goto LABEL_4;
    }
  }
}

Referenced by: