ObpCaptureObjectCreateInformation

NTSTATUS __stdcall ObpCaptureObjectCreateInformation(
        INT8 ProbeMode,
        INT8 CreatorMode,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        _UNICODE_STRING *CapturedObjectName,
        _OBJECT_CREATE_INFORMATION *ObjectCreateInfo,
        UINT64 UseLookaside){
  int Attributes; 
  _UNICODE_STRING *ObjectName; 
  void *SecurityDescriptor; 
  _SECURITY_QUALITY_OF_SERVICE *SecurityQualityOfService; 
  int v12; 
  void **p_SecurityDescriptor; 
  void *v15; 
  INT64 v16; 
  INT64 v17; 
  int Size_4; 
  int v19; 
  _SECURITY_QUALITY_OF_SERVICE *v20; 
  _UNICODE_STRING *v21; 
  void *v22; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v24; 

  HIDWORD(v17) = 0;
  *CapturedObjectName = 0i64;
  *(_OWORD *)&ObjectCreateInfo->Attributes = 0i64;
  *(_OWORD *)&ObjectCreateInfo->ProbeMode = 0i64;
  *(_OWORD *)&ObjectCreateInfo->SecurityDescriptor = 0i64;
  *(_OWORD *)&ObjectCreateInfo->SecurityQualityOfService.Length = 0i64;
  if( !ObjectAttributes )
    return 0;
  ObjectCreateInfo->ProbeMode = ProbeMode;
  if( ProbeMode )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    if( CurrentThread->Tcb.PreviousMode )
    {
      if( ((unsigned __int8)ObjectAttributes & 7) != 0 )
        goto LABEL_18;
    }
  }
  if( ObjectAttributes->Length != 48 )
  {
    v12 = -1073741811;
    Size_4 = -1073741811;
    goto LABEL_33;
  }
  ObjectCreateInfo->RootDirectory = ObjectAttributes->RootDirectory;
  Attributes = ObjectAttributes->Attributes;
  v19 = Attributes;
  if( CreatorMode )
  {
    Attributes &= ~0x200u;
    v19 = Attributes;
  }
  if( (Attributes & 0xFFFEE00D) != 0 )
  {
    v12 = -1073741811;
    Size_4 = -1073741811;
    goto LABEL_33;
  }
  ObjectCreateInfo->Attributes = Attributes;
  ObjectName = ObjectAttributes->ObjectName;
  v21 = ObjectName;
  SecurityDescriptor = ObjectAttributes->SecurityDescriptor;
  v22 = SecurityDescriptor;
  SecurityQualityOfService = (_SECURITY_QUALITY_OF_SERVICE *)ObjectAttributes->SecurityQualityOfService;
  v20 = SecurityQualityOfService;
  if( SecurityQualityOfService )
  {
    if( !ProbeMode )
    {
LABEL_14:
      ObjectCreateInfo->SecurityQualityOfService = *SecurityQualityOfService;
      goto LABEL_19;
    }
    v24 = (_ETHREAD *)KeGetCurrentThread();
    BYTE1(v17) = v24->Tcb.PreviousMode;
    if( !BYTE1(v17) || ((unsigned __int8)v20 & 3) == 0 )
    {
      SecurityQualityOfService = v20;
      SecurityDescriptor = v22;
      ObjectName = v21;
      goto LABEL_14;
    }
LABEL_18:
    ExRaiseDatatypeMisalignment();
  }
LABEL_19:
  if( SecurityDescriptor )
  {
    p_SecurityDescriptor = &ObjectCreateInfo->SecurityDescriptor;
    v12 = SeCaptureSecurityDescriptor(
            SecurityDescriptor,
            ProbeMode,
            PagedPool,
            1u,
            &ObjectCreateInfo->SecurityDescriptor,
            v16,
            v17);
    if( v12 < 0 )
    {
      *p_SecurityDescriptor = 0i64;
      goto LABEL_33;
    }
    SeComputeQuotaInformationSize(*p_SecurityDescriptor, (UINT64 *)((char *)&v17 + 4));
    ObjectCreateInfo->SecurityDescriptorCharge = HIDWORD(v17);
  }
  if( !SecurityQualityOfService )
    goto LABEL_21;
  ObjectCreateInfo->SecurityQualityOfService.Length = 12;
  ObjectCreateInfo->SecurityQos = &ObjectCreateInfo->SecurityQualityOfService;
  if( ObjectCreateInfo->SecurityQualityOfService.ContextTrackingMode >= 2u )
  {
    v12 = -1073741811;
    goto LABEL_33;
  }
  if( ObjectCreateInfo->SecurityQualityOfService.ImpersonationLevel > (unsigned int)SecurityDelegation )
  {
    v12 = -1073741659;
  }
  else
  {
LABEL_21:
    if( ObjectName )
    {
      v12 = ObpCaptureObjectName(ProbeMode, ObjectName, CapturedObjectName, (unsigned int)UseLookaside);
      if( v12 >= 0 )
        return 0;
    }
    else
    {
      if( !ObjectCreateInfo->RootDirectory )
        return 0;
      v12 = -1073741773;
    }
  }
LABEL_33:
  v15 = ObjectCreateInfo->SecurityDescriptor;
  if( v15 )
  {
    SeReleaseSecurityDescriptor(v15, ObjectCreateInfo->ProbeMode, 1u);
    ObjectCreateInfo->SecurityDescriptor = 0i64;
  }
  return v12;
}

Referenced by: