RtlIsUntrustedObject

NTSTATUS __stdcall RtlIsUntrustedObject(
        VOID *Handle,
        VOID *Object,
        UINT8 *UntrustedObject,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  char *PoolWithQuotaTag; 
  char v11; 
  NTSTATUS result; 
  NTSTATUS v13; 
  __int16 v14; 
  __int64 v15; 
  _ACL *v16; 
  _DWORD *AceByType; 
  NTSTATUS SecurityObject; 
  int v19; 
  UINT64 pIndex; 
  UINT8 *v21; 
  char SecurityDescriptor[128]; 

  LODWORD(pIndex) = 0;
  PoolWithQuotaTag = SecurityDescriptor;
  v21 = UntrustedObject;
  *UntrustedObject = 1;
  if( Object )
  {
    if( !Handle )
      goto LABEL_3;
    return -1073741811;
  }
  if( !Handle )
    return -1073741811;
LABEL_3:
  v11 = 0;
  if( Handle )
  {
    result = ZwQuerySecurityObject((UINT64)Handle, 16i64, (UINT64)SecurityDescriptor, 0x7Cui64, (UINT64)&pIndex);
    v13 = result;
    if( result >= 0 )
      goto LABEL_5;
    if( result == -1073741789 )
    {
      PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, (unsigned int)pIndex, 0x62507452ui64);
      if( !PoolWithQuotaTag )
        return -1073741801;
      v11 = 1;
      SecurityObject = ZwQuerySecurityObject((UINT64)Handle, 16i64, (UINT64)PoolWithQuotaTag, 0x7Cui64, (UINT64)&pIndex);
      goto LABEL_24;
    }
  }
  else
  {
    result = ObQuerySecurityObject(Object, 0x10ui64, SecurityDescriptor, 0x7Cui64, &pIndex);
    v13 = result;
    if( result >= 0 )
      goto LABEL_5;
    if( result == -1073741789 )
    {
      PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, (unsigned int)pIndex, 0x62507452ui64);
      if( !PoolWithQuotaTag )
        return -1073741801;
      v11 = 1;
      SecurityObject = ObQuerySecurityObject(Object, 0x10ui64, PoolWithQuotaTag, 0x7Cui64, &pIndex);
LABEL_24:
      v13 = SecurityObject;
      if( SecurityObject < 0 )
      {
LABEL_25:
        ExFreePoolWithTag(PoolWithQuotaTag, 0);
        return v13;
      }
LABEL_5:
      v14 = *((_WORD *)PoolWithQuotaTag + 1);
      if( (v14 & 0x10) != 0 )
      {
        if( v14 >= 0 )
        {
          v16 = (_ACL *)*((_QWORD *)PoolWithQuotaTag + 3);
        }
        else
        {
          v15 = *((unsigned int *)PoolWithQuotaTag + 3);
          if( !(_DWORD)v15 )
            goto LABEL_12;
          v16 = (_ACL *)&PoolWithQuotaTag[v15];
        }
        if( v16 )
        {
          HIDWORD(pIndex) = 0;
          while( 1 )
          {
            AceByType = RtlFindAceByType(v16, 0x11ui64, (UINT64 *)((char *)&pIndex + 4));
            if( !AceByType )
              break;
            if( (*((_BYTE *)AceByType + 1) & 8) == 0 )
            {
              v19 = *((unsigned __int8 *)AceByType + 9);
              if( !(_BYTE)v19 || AceByType[v19 - 1 + 4] < 0x2000u )
                goto LABEL_13;
              break;
            }
          }
        }
      }
LABEL_12:
      *v21 = 0;
LABEL_13:
      if( !v11 )
        return v13;
      goto LABEL_25;
    }
  }
  return result;
}

Referenced by: