SepRmFetchGlobalSacl

INT64 __stdcall SepRmFetchGlobalSacl(const _UNICODE_STRING *ObjectType, UINT64 *AclSize, UINT8 **ppSacl){
  __int64 Length; 
  UINT64 v7; 
  WCHAR *PoolWithTag; 
  UINT64 v9; 
  signed int v10; 
  UINT64 v11; 
  WCHAR *v12; 
  WCHAR v13; 
  WCHAR *v14; 
  NTSTATUS v15; 
  UINT8 *v17; 
  UINT8 *v18; 
  ULONG ResultLength; 
  HANDLE KeyHandle; 
  Length = ObjectType->Length;
  KeyHandle = 0i64;
  ResultLength = 0;
  v7 = Length + 98;
  PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v7, 0x6C635347ui64);
  if( !PoolWithTag )
    goto LABEL_18;
  v9 = v7 >> 1;
  v10 = v9 == 0 ? 0xC000000D : 0;
  if( v9 )
  {
    v11 = v9;
    v12 = PoolWithTag;
    do
    {
      if( !(2147483646 - v9 + v11) )
        break;
      v13 = *(WCHAR *)((char *)v12
                     + (char *)L"\\Registry\\Machine\\SECURITY\\Policy\\GlobalSaclName"
                     - (char *)PoolWithTag);
      if( !v13 )
        break;
      *v12++ = v13;
      --v11;
    }
    while( v11 );
    v14 = v12 - 1;
    if( v11 )
      v14 = v12;
    v10 = v11 == 0 ? 0x80000005 : 0;
    *v14 = 0;
  }
  if( v10 >= 0 )
    RtlStringCchCatNW(PoolWithTag, v9, ObjectType->Buffer, (unsigned __int64)ObjectType->Length >> 1);
  v15 = SepRegOpenKey(PoolWithTag, 0x201ui64, &KeyHandle);
  if( v15 >= 0 )
  {
    v15 = ZwQueryValueKey(KeyHandle, &DefaultKey, KeyValuePartialInformation, 0i64, 0, &ResultLength);
    if( ((int)(v15 + 0x80000000) < 0 || v15 == -1073741789) && ResultLength <= 0x1000B )
    {
      v15 = 0;
      if( ResultLength <= 0xC )
      {
        *(_DWORD *)AclSize = 0;
        *ppSacl = 0i64;
        goto LABEL_13;
      }
      v17 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, ResultLength, 0x6C635347ui64);
      if( v17 )
      {
        v15 = ZwQueryValueKey(KeyHandle, &DefaultKey, KeyValuePartialInformation, v17, ResultLength, &ResultLength);
        if( v15 >= 0 )
        {
          ResultLength -= 12;
          v18 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, ResultLength, 0x6C635347ui64);
          *ppSacl = v18;
          if( v18 )
          {
            memmove(v18, v17 + 12, ResultLength);
            *(_DWORD *)AclSize = ResultLength;
          }
          else
          {
            v15 = -1073741801;
          }
        }
        ExFreePoolWithTag(v17, 0);
        goto LABEL_13;
      }
LABEL_18:
      v15 = -1073741801;
    }
  }
LABEL_13:
  if( KeyHandle )
  {
    ZwClose(KeyHandle);
    KeyHandle = 0i64;
  }
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return(unsigned int)v15;
}

Referenced by: