ObInsertObjectEx

NTSTATUS __stdcall ObInsertObjectEx(
        VOID *Object,
        _ACCESS_STATE *AccessState,
        UINT64 DesiredAccess,
        UINT64 ObjectPointerBias,
        UINT64 Flags,
        VOID **NewObject,
        VOID **Handle){
  __int64 v9; 
  _OBJECT_HEADER *v10; 
  char *v11; 
  NTSTATUS v12; 
  unsigned __int64 v13; 
  POBJECT_TYPE v14; 
  _OBJECT_HEADER *v15; 
  char *v16; 
  char AccessMode; 
  int v18; 
  VOID *v19; 
  struct _KPRCB *CurrentPrcb; 
  _GENERAL_LOOKASIDE *L; 
  int v23; 
  _BYTE *v24; 
  __int64 v25; 
  VOID *v26; 
  int v27; 
  VOID *v28; 
  void *v29; 
  bool v30; 
  int v31; 
  _OBJECT_CREATE_INFORMATION *InsertObjectCreateInfo; 
  int v33; 
  unsigned __int8 v34; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v36; 
  ULONG_PTR v37; 
  VOID *v38; 
  struct _KPRCB *v39; 
  _GENERAL_LOOKASIDE *v40; 
  UINT64 ObjectPointerBiasa; 
  UINT64 Attributes; 
  UINT64 MaxRelativeAccessMask; 
  int MaxRelativeAccessMaska; 
  POOL_TYPE ReferencedNewObject; 
  VOID **ReferencedNewObjecta; 
  VOID **ReferencedNewObjectb; 
  INT8 v48; 
  unsigned int DesiredAccessa; 
  UINT64 AutoInheritFlags; 
  _SECURITY_OBJECT_AI_PARAMS AutoInheritParams; 
  PVOID P; 
  VOID *NewDescriptor; 
  char *v54; 
  VOID **v55; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  char v57[160]; 
  _AUX_ACCESS_DATA AuxData; 

  DesiredAccessa = DesiredAccess;
  v55 = NewObject;
  HIDWORD(AutoInheritFlags) = ObjectPointerBias;
  memset(&AuxData, 0i64, sizeof(AuxData));
  memset(v57, 0i64, sizeof(v57));
  v9 = *((_QWORD *)Object - 2);
  v10 = (_OBJECT_HEADER *)((char *)Object - 48);
  v11 = 0i64;
  v12 = 0;
  v13 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  v54 = 0i64;
  v14 = (POBJECT_TYPE)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v13];
  if( (*((char *)Object - 22) & 2) != 0 )
  {
    v15 = (_OBJECT_HEADER *)*((unsigned __int8 *)&dword_140C25D60 + (*((char *)Object - 22) & 3));
    v16 = (char *)((char *)v10 - (char *)v15);
    if( v10 != v15 )
    {
      v11 = v16 + 8;
      v54 = v16 + 8;
    }
  }
  AccessMode = KeGetCurrentThread()->PreviousMode;
  v48 = AccessMode;
  if( (v14->TypeInfo._bf_0 & 8) == 0 && !v11 && !*(_QWORD *)(v9 + 32) )
  {
    v10->ObjectCreateInfo = 0i64;
    if( Handle )
    {
      v18 = HIDWORD(AutoInheritFlags) + 1;
      ReferencedNewObjecta = v55;
      LODWORD(MaxRelativeAccessMask) = 0;
      *Handle = 0i64;
      LODWORD(Attributes) = *(_DWORD *)v9;
      LODWORD(ObjectPointerBiasa) = v18;
      v12 = ObpCreateHandle(
              ObCreateHandle,
              Object,
              DesiredAccessa,
              0i64,
              ObjectPointerBiasa,
              Attributes,
              AccessMode,
              0i64,
              MaxRelativeAccessMask,
              ReferencedNewObjecta,
              Handle);
    }
    v19 = *(VOID **)(v9 + 32);
    if( v19 )
    {
      SeReleaseSecurityDescriptor(v19, *(_BYTE *)(v9 + 16), 1u);
      *(_QWORD *)(v9 + 32) = 0i64;
    }
    CurrentPrcb = KeGetCurrentPrcb();
    L = CurrentPrcb->PPLookasideList[4].P;
    ++L->TotalFrees;
    if( LOWORD(L->ListHead.Alignment) >= L->Depth )
    {
      ++L->FreeMisses;
      L = CurrentPrcb->PPLookasideList[4].L;
      ++L->TotalFrees;
      if( LOWORD(L->ListHead.Alignment) >= L->Depth )
      {
        ++L->FreeMisses;
        ((void(__fastcall *)(__int64))L->FreeEx)(v9);
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
        return v12;
      }
    }
    RtlpInterlockedPushEntrySList(&L->ListHead, (PSLIST_ENTRY)v9);
    goto LABEL_15;
  }
  if( !AccessState )
  {
    AccessState = (_ACCESS_STATE *)v57;
    memset(&SubjectContext, 0, sizeof(SubjectContext));
    SeCaptureSubjectContextEx((PETHREAD)KeGetCurrentThread(), KeGetCurrentThread()->ApcState.Process, &SubjectContext);
    SepCreateAccessStateFromSubjectContext(
      &SubjectContext,
      (_ACCESS_STATE *)v57,
      &AuxData,
      DesiredAccessa,
      &v14->TypeInfo.GenericMapping);
    v12 = v23;
    if( v23 < 0 )
    {
LABEL_15:
      HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      return v12;
    }
  }
  v24 = *(_BYTE **)(v9 + 32);
  *((_QWORD *)AccessState + 8) = v24;
  if( !v24 )
  {
LABEL_23:
    v25 = (__int64)v54;
    if( !v54 && ((v14->TypeInfo._bf_0 & 8) != 0 || *(char **)(v9 + 32) != v54) )
    {
      v26 = (VOID *)*((_QWORD *)AccessState + 8);
      AutoInheritParams.ConstraintMask = 0;
      LODWORD(AutoInheritFlags) = 0;
      NewDescriptor = 0i64;
      P = 0i64;
      AutoInheritParams.Size = 8;
      v27 = SeComputeAutoInheritByObjectTypeEx(v14, v26, 0i64, &AutoInheritFlags, &AutoInheritParams);
      if( v27 < 0 )
      {
LABEL_32:
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
        if( AccessState == (_ACCESS_STATE *)v57 )
        {
          SepDeleteAccessState(AccessState);
          SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
        }
        return v27;
      }
      v28 = P;
      if( !P )
        v28 = (VOID *)*((_QWORD *)AccessState + 8);
      LODWORD(Attributes) = (16 * (Flags & 1)) | AutoInheritFlags;
      v27 = SeAssignSecurityEx2(
              0i64,
              v28,
              &NewDescriptor,
              0i64,
              v14 == DmaAdapter,
              Attributes,
              &AutoInheritParams,
              (_SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
              &v14->TypeInfo.GenericMapping,
              ReferencedNewObject);
      if( v27 < 0 )
      {
        if( P )
          ExFreePoolWithTag(P, 0);
        goto LABEL_32;
      }
      if( P )
        ExFreePoolWithTag(P, 0);
      LOBYTE(MaxRelativeAccessMaska) = KeGetCurrentThread()->PreviousMode;
      v27 = v14->TypeInfo.SecurityProcedure(
              Object,
              AssignSecurityDescriptor,
              0i64,
              NewDescriptor,
              0i64,
              0i64,
              PagedPool,
              &v14->TypeInfo.GenericMapping,
              MaxRelativeAccessMaska);
      if( v27 < 0 )
      {
        SeDeassignSecurity(&NewDescriptor);
        goto LABEL_32;
      }
      v29 = *(void **)(v9 + 32);
      if( *(_BYTE *)(v9 + 16) <= 1u && v29 )
        ExFreePoolWithTag(v29, 0);
      v25 = (__int64)v54;
      v10 = (_OBJECT_HEADER *)((char *)Object - 48);
      *(_QWORD *)(v9 + 32) = 0i64;
      *((_QWORD *)AccessState + 8) = 0i64;
    }
    v10->ObjectCreateInfo = 0i64;
    if( Handle )
    {
      v30 = v25 == 0;
      v31 = HIDWORD(AutoInheritFlags);
      InsertObjectCreateInfo = 0i64;
      if( !v30 )
        InsertObjectCreateInfo = (_OBJECT_CREATE_INFORMATION *)v9;
      ReferencedNewObjectb = v55;
      LODWORD(MaxRelativeAccessMask) = 0;
      *Handle = 0i64;
      LODWORD(Attributes) = *(_DWORD *)v9;
      LODWORD(ObjectPointerBiasa) = v31 + 1;
      v33 = ObpCreateHandle(
              ObCreateHandle,
              Object,
              0i64,
              AccessState,
              ObjectPointerBiasa,
              Attributes,
              v48,
              InsertObjectCreateInfo,
              MaxRelativeAccessMask,
              ReferencedNewObjectb,
              Handle);
      HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      goto LABEL_57;
    }
    if( AccessState != (_ACCESS_STATE *)v57 )
    {
      v34 = v48;
      if( (*(_DWORD *)v9 & 0x400) != 0 )
        v34 = 1;
      v33 = ObpAdjustCreatorAccessState(AccessState, v34, v14, Object);
      if( v33 < 0 )
        goto LABEL_56;
      v10 = (_OBJECT_HEADER *)((char *)Object - 48);
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&v10->Lock, 0i64);
    v36 = ObpChargeQuotaForObject(v10, KeGetCurrentThread()->ApcState.Process, 0i64);
    v37 = (_DWORD)v10 + 16;
    v33 = v36;
    ExReleasePushLockEx(v37, 0);
    KeLeaveCriticalRegion();
    if( v33 >= 0 )
    {
LABEL_57:
      v38 = *(VOID **)(v9 + 32);
      if( v38 )
      {
        SeReleaseSecurityDescriptor(v38, *(_BYTE *)(v9 + 16), 1u);
        *(_QWORD *)(v9 + 32) = 0i64;
      }
      v39 = KeGetCurrentPrcb();
      v40 = v39->PPLookasideList[4].P;
      ++v40->TotalFrees;
      if( LOWORD(v40->ListHead.Alignment) < v40->Depth
        || (++v40->FreeMisses,
            v40 = v39->PPLookasideList[4].L,
            ++v40->TotalFrees,
            LOWORD(v40->ListHead.Alignment) < v40->Depth) )
      {
        RtlpInterlockedPushEntrySList(&v40->ListHead, (PSLIST_ENTRY)v9);
      }
      else
      {
        ++v40->FreeMisses;
        ((void(__fastcall *)(__int64))v40->FreeEx)(v9);
      }
      if( AccessState == (_ACCESS_STATE *)v57 )
      {
        SepDeleteAccessState(AccessState);
        SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
      }
      return v33;
    }
LABEL_56:
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
    goto LABEL_57;
  }
  if( RtlValidSecurityDescriptor(v24) )
  {
    if( (v24[2] & 0x10) != 0 && (*((_DWORD *)AccessState + 5) & 0x1000000) == 0 )
      *((_DWORD *)AccessState + 4) |= SeObjectCreateSaclAccessBits(v24);
    goto LABEL_23;
  }
  HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  if( AccessState == (_ACCESS_STATE *)v57 )
  {
    SepDeleteAccessState(AccessState);
    SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
  }
  return -1073741703;
}

Referenced by: