NtQuerySecurityObject

NTSTATUS __fastcall NtQuerySecurityObject(UINT64 a1, INT64 a2, UINT64 a3, UINT64 a4, UINT64 LengthNeeded){
  char PreviousMode; 
  _DWORD *v8; 
  UINT64 v9; 
  NTSTATUS result; 
  _ADAPTER_OBJECT *v11; 
  __int64 v12; 
  NTSTATUS v13; 
  UINT64 DesiredAccess; 
  PVOID Object; 
  _OBJECT_HANDLE_INFORMATION HandleInformation; 
  UINT64 SecurityInformation; 
  UINT64 Length; 

  LODWORD(Length) = a4;
  LODWORD(SecurityInformation) = a2;
  LODWORD(DesiredAccess) = 0;
  HandleInformation = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v8 = (_DWORD *)LengthNeeded;
    v9 = LengthNeeded;
    if( LengthNeeded >= 0x7FFFFFFF0000i64 )
      v9 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v9 = *(_DWORD *)v9;
    ProbeForWrite(a3, (unsigned int)Length, 4i64);
  }
  else
  {
    v8 = (_DWORD *)LengthNeeded;
  }
  SeQuerySecurityAccessMask((unsigned int)SecurityInformation, &DesiredAccess);
  Object = 0i64;
  result = ObReferenceObjectByHandle(
             (VOID *)a1,
             (unsigned int)DesiredAccess,
             0i64,
             PreviousMode,
             &Object,
             &HandleInformation);
  if( result >= 0 )
  {
    v11 = (_ADAPTER_OBJECT *)Object;
    v12 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
    v13 = (*(__int64(__fastcall **)(PVOID, __int64, UINT64 *, UINT64, UINT64 *, char *, _DWORD, __int64, char))(v12 + 152))(
            Object,
            1i64,
            &SecurityInformation,
            a3,
            &Length,
            (char *)Object - 8,
            *(_DWORD *)(v12 + 100),
            v12 + 76,
            PreviousMode);
    *v8 = Length;
    HalPutDmaAdapter(v11);
    return v13;
  }
  return result;
}

Referenced by: