NtQuerySecurityPolicy

NTSTATUS __stdcall NtQuerySecurityPolicy(
        _UNICODE_STRING *Provider,
        _UNICODE_STRING *Key,
        _UNICODE_STRING *ValueName,
        _SECURE_SETTING_VALUE_TYPE *ValueType,
        VOID *Value,
        UINT64 *ValueSize){
  VOID *PoolWithQuotaTag; 
  char PreviousMode; 
  int v11; 
  UINT64 *v12; 
  VOID *v13; 
  size_t v14; 
  UINT64 Length; 
  VOID *v17; 
  _UNICODE_STRING *CapturedArray; 
  PVOID P; 
  PVOID v20; 

  CapturedArray = 0i64;
  P = 0i64;
  PoolWithQuotaTag = 0i64;
  v17 = 0i64;
  v20 = 0i64;
  Length = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v11 = SepCaptureUnicodeStringArray(Provider, 1ui64, PreviousMode, (const _UNICODE_STRING **)&CapturedArray);
  if( v11 >= 0 )
  {
    v11 = SepCaptureUnicodeStringArray(Key, 1ui64, PreviousMode, (const _UNICODE_STRING **)&P);
    if( v11 >= 0 )
    {
      v11 = SepCaptureUnicodeStringArray(ValueName, 1ui64, PreviousMode, (const _UNICODE_STRING **)&v20);
      if( v11 >= 0 )
      {
        if( PreviousMode == 1 )
        {
          ProbeForWrite((UINT64)ValueType, 4i64, 4i64);
          v12 = ValueSize;
          if( ((unsigned __int8)ValueSize & 3) != 0 )
            ExRaiseDatatypeMisalignment();
          if( (unsigned __int64)ValueSize + 4 > 0x7FFFFFFF0000i64 || (UINT64 *)((char *)ValueSize + 4) < ValueSize )
            MEMORY[0x7FFFFFFF0000] = 0;
          LODWORD(Length) = *(_DWORD *)ValueSize;
          ProbeForWrite((UINT64)ValueSize, 4i64, 4i64);
          v13 = Value;
          if( Value )
            ProbeForWrite((UINT64)Value, (unsigned int)Length, 1i64);
          if( Value )
          {
            PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)9, (unsigned int)Length, 0x20206553ui64);
            v17 = PoolWithQuotaTag;
            if( !PoolWithQuotaTag )
            {
              v11 = -1073741670;
              goto LABEL_28;
            }
          }
        }
        else
        {
          v13 = Value;
          PoolWithQuotaTag = Value;
          v17 = Value;
          v12 = ValueSize;
          LODWORD(Length) = *(_DWORD *)ValueSize;
        }
        if( qword_140C1D958 )
        {
          if( !PoolWithQuotaTag || (_DWORD)Length )
            v11 = qword_140C1D958(CapturedArray, P, v20, (char *)&Length + 4, PoolWithQuotaTag, &Length);
          else
            v11 = -1073741811;
        }
        else
        {
          v11 = -1073741637;
        }
        if( (int)(v11 + 0x80000000) < 0 || v11 == -1073741789 )
        {
          *ValueType = SHIDWORD(Length);
          v14 = Length;
          *(_DWORD *)v12 = Length;
          if( v13 )
          {
            if( PreviousMode == 1 && v11 >= 0 )
              memmove(v13, PoolWithQuotaTag, v14);
          }
        }
      }
    }
  }
LABEL_28:
  if( PreviousMode == 1 )
  {
    if( CapturedArray )
      ExFreePoolWithTag(CapturedArray, 0);
    if( P )
      ExFreePoolWithTag(P, 0);
    if( v20 )
      ExFreePoolWithTag(v20, 0);
  }
  if( PoolWithQuotaTag && PreviousMode == 1 )
    ExFreePoolWithTag(PoolWithQuotaTag, 0);
  return v11;
}

Referenced by: