ObInsertObjectEx

NTSTATUS __stdcall ObInsertObjectEx(
        PVOID Object,
        ACCESS_STATE *AccessState,
        UINT64 DesiredAccess,
        UINT64 ObjectPointerBias,
        UINT64 Flags,
        PVOID *NewObject,
        PVOID *Handle){
  __int64 v9; 
  _OBJECT_HEADER *v10; 
  char *v11; 
  NTSTATUS v12; 
  unsigned __int64 v13; 
  POBJECT_TYPE v14; 
  _OBJECT_HEADER *v15; 
  char *v16; 
  char v17; 
  unsigned int v18; 
  void *v19; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v21; 
  int v23; 
  _BYTE *v24; 
  __int64 v25; 
  void *v26; 
  int v27; 
  PVOID v28; 
  void *v29; 
  bool v30; 
  int v31; 
  _ETHREAD *v32; 
  NTSTATUS v33; 
  KPROCESSOR_MODE v34; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v36; 
  UINT64 p_Lock; 
  void *v38; 
  struct _KPRCB *v39; 
  __int64 v40; 
  BOOL GenericMapping; 
  UINT64 AutoInheritFlags; 
  int v43; 
  PVOID *v44; 
  PVOID *v45; 
  char v46; 
  DWORD DesiredAccessa; 
  UINT64 DesiredAccess_4; 
  _SECURITY_OBJECT_AI_PARAMS AutoInheritParams; 
  PVOID P; 
  PSECURITY_DESCRIPTOR SecurityDescriptor; 
  char *v52; 
  PVOID *v53; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int64 v55[20]; 
  __int64 result[28]; 
  DesiredAccessa = DesiredAccess;
  v53 = NewObject;
  HIDWORD(DesiredAccess_4) = ObjectPointerBias;
  memset((INT64)result, 0i64);
  memset((INT64)v55, 0i64);
  v9 = *((_QWORD *)Object - 2);
  v10 = (_OBJECT_HEADER *)((char *)Object - 48);
  v11 = 0i64;
  v12 = 0;
  v13 = (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  v52 = 0i64;
  v14 = (POBJECT_TYPE)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v13];
  if( (*((char *)Object - 22) & 2) != 0 )
  {
    v15 = (_OBJECT_HEADER *)*((unsigned __int8 *)ObpInfoMaskToOffset + (*((char *)Object - 22) & 3));
    v16 = (char *)((char *)v10 - (char *)v15);
    if( v10 != v15 )
    {
      v11 = v16 + 8;
      v52 = v16 + 8;
    }
  }
  v17 = *((_BYTE *)KeGetCurrentThread() + 562);
  v46 = v17;
  if( (v14->TypeInfo.ObjectTypeFlags & 8) == 0 && !v11 && !*(_QWORD *)(v9 + 32) )
  {
    v10->ObjectCreateInfo = 0i64;
    if( Handle )
    {
      v18 = HIDWORD(DesiredAccess_4) + 1;
      v44 = v53;
      *Handle = 0i64;
      v12 = ObpCreateHandle(
              0,
              (char *)Object,
              DesiredAccessa,
              0i64,
              v18,
              *(_DWORD *)v9,
              v17,
              0i64,
              0,
              v44,
              (__int64 *)Handle);
    }
    v19 = *(void **)(v9 + 32);
    if( v19 )
    {
      SeReleaseSecurityDescriptor(v19, *(_BYTE *)(v9 + 16), 1u);
      *(_QWORD *)(v9 + 32) = 0i64;
    }
    CurrentPrcb = KeGetCurrentPrcb();
    v21 = *((_QWORD *)CurrentPrcb + 264);
    ++*(_DWORD *)(v21 + 28);
    if( *(_WORD *)v21 >= *(_WORD *)(v21 + 16) )
    {
      ++*(_DWORD *)(v21 + 32);
      v21 = *((_QWORD *)CurrentPrcb + 265);
      ++*(_DWORD *)(v21 + 28);
      if( *(_WORD *)v21 >= *(_WORD *)(v21 + 16) )
      {
        ++*(_DWORD *)(v21 + 32);
        (*(void(__fastcall **)(__int64))(v21 + 56))(v9);
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
        return v12;
      }
    }
    RtlpInterlockedPushEntrySList((PSLIST_HEADER)v21, (PSLIST_ENTRY)v9);
    goto LABEL_15;
  }
  if( !AccessState )
  {
    AccessState = (ACCESS_STATE *)v55;
    memset(&SubjectContext, 0, sizeof(SubjectContext));
    SeCaptureSubjectContextEx(
      (_ETHREAD *)KeGetCurrentThread(),
      *((_EPROCESS **)KeGetCurrentThread() + 23),
      &SubjectContext);
    SepCreateAccessStateFromSubjectContext(
      &SubjectContext,
      (_ACCESS_STATE *)v55,
      (_AUX_ACCESS_DATA *)result,
      DesiredAccessa,
      &v14->TypeInfo.GenericMapping);
    v12 = v23;
    if( v23 < 0 )
    {
LABEL_15:
      HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      return v12;
    }
  }
  v24 = *(_BYTE **)(v9 + 32);
  *((_QWORD *)AccessState + 8) = v24;
  if( !v24 )
  {
LABEL_23:
    v25 = (__int64)v52;
    if( !v52 && ((v14->TypeInfo.ObjectTypeFlags & 8) != 0 || *(char **)(v9 + 32) != v52) )
    {
      v26 = (void *)*((_QWORD *)AccessState + 8);
      AutoInheritParams.ConstraintMask = 0;
      LODWORD(DesiredAccess_4) = 0;
      SecurityDescriptor = 0i64;
      P = 0i64;
      AutoInheritParams.Size = 8;
      v27 = SeComputeAutoInheritByObjectTypeEx(v14, v26, 0i64, &DesiredAccess_4, &AutoInheritParams);
      if( v27 < 0 )
      {
LABEL_32:
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
        if( AccessState == (ACCESS_STATE *)v55 )
        {
          SepDeleteAccessState(AccessState);
          SeReleaseSubjectContext((_SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
        }
        return v27;
      }
      v28 = P;
      if( !P )
        v28 = (PVOID)*((_QWORD *)AccessState + 8);
      LODWORD(AutoInheritFlags) = (16 * (Flags & 1)) | DesiredAccess_4;
      LOBYTE(GenericMapping) = v14 == ObpDirectoryObjectType;
      v27 = SeAssignSecurityEx2(
              0i64,
              v28,
              &SecurityDescriptor,
              0i64,
              GenericMapping,
              AutoInheritFlags,
              &AutoInheritParams,
              (SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
              &v14->TypeInfo.GenericMapping);
      if( v27 < 0 )
      {
        if( P )
          ExFreePoolWithTag(P, 0);
        goto LABEL_32;
      }
      if( P )
        ExFreePoolWithTag(P, 0);
      LOBYTE(v43) = *((_BYTE *)KeGetCurrentThread() + 562);
      v27 = v14->TypeInfo.SecurityProcedure(
              Object,
              AssignSecurityDescriptor,
              0i64,
              SecurityDescriptor,
              0i64,
              0i64,
              PagedPool,
              &v14->TypeInfo.GenericMapping,
              v43);
      if( v27 < 0 )
      {
        SeDeassignSecurity(&SecurityDescriptor);
        goto LABEL_32;
      }
      v29 = *(void **)(v9 + 32);
      if( *(_BYTE *)(v9 + 16) <= 1u && v29 )
        ExFreePoolWithTag(v29, 0);
      v25 = (__int64)v52;
      v10 = (_OBJECT_HEADER *)((char *)Object - 48);
      *(_QWORD *)(v9 + 32) = 0i64;
      *((_QWORD *)AccessState + 8) = 0i64;
    }
    v10->ObjectCreateInfo = 0i64;
    if( Handle )
    {
      v30 = v25 == 0;
      v31 = HIDWORD(DesiredAccess_4);
      v32 = 0i64;
      if( !v30 )
        v32 = (_ETHREAD *)v9;
      v45 = v53;
      *Handle = 0i64;
      v33 = ObpCreateHandle(
              0,
              (char *)Object,
              0,
              AccessState,
              v31 + 1,
              *(_DWORD *)v9,
              v46,
              v32,
              0,
              v45,
              (__int64 *)Handle);
      HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      goto LABEL_57;
    }
    if( AccessState != (ACCESS_STATE *)v55 )
    {
      v34 = v46;
      if( (*(_DWORD *)v9 & 0x400) != 0 )
        v34 = 1;
      v33 = ObpAdjustCreatorAccessState(AccessState, v34, (__int64)v14, (__int64)Object);
      if( v33 < 0 )
        goto LABEL_56;
      v10 = (_OBJECT_HEADER *)((char *)Object - 48);
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx((UINT64)&v10->Lock, 0i64);
    v36 = ObpChargeQuotaForObject(v10, *((_EPROCESS **)KeGetCurrentThread() + 23), 0i64);
    p_Lock = (UINT64)&v10->Lock;
    v33 = v36;
    ExReleasePushLockEx(p_Lock, 0i64);
    KeLeaveCriticalRegion();
    if( v33 >= 0 )
    {
LABEL_57:
      v38 = *(void **)(v9 + 32);
      if( v38 )
      {
        SeReleaseSecurityDescriptor(v38, *(_BYTE *)(v9 + 16), 1u);
        *(_QWORD *)(v9 + 32) = 0i64;
      }
      v39 = KeGetCurrentPrcb();
      v40 = *((_QWORD *)v39 + 264);
      ++*(_DWORD *)(v40 + 28);
      if( *(_WORD *)v40 < *(_WORD *)(v40 + 16)
        || (++*(_DWORD *)(v40 + 32),
            v40 = *((_QWORD *)v39 + 265),
            ++*(_DWORD *)(v40 + 28),
            *(_WORD *)v40 < *(_WORD *)(v40 + 16)) )
      {
        RtlpInterlockedPushEntrySList((PSLIST_HEADER)v40, (PSLIST_ENTRY)v9);
      }
      else
      {
        ++*(_DWORD *)(v40 + 32);
        (*(void(__fastcall **)(__int64))(v40 + 56))(v9);
      }
      if( AccessState == (ACCESS_STATE *)v55 )
      {
        SepDeleteAccessState(AccessState);
        SeReleaseSubjectContext((_SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
      }
      return v33;
    }
LABEL_56:
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
    goto LABEL_57;
  }
  if( RtlValidSecurityDescriptor(v24) )
  {
    if( (v24[2] & 0x10) != 0 && (*((_DWORD *)AccessState + 5) & 0x1000000) == 0 )
      *((_DWORD *)AccessState + 4) |= SeObjectCreateSaclAccessBits(v24);
    goto LABEL_23;
  }
  HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  if( AccessState == (ACCESS_STATE *)v55 )
  {
    SepDeleteAccessState(AccessState);
    SeReleaseSubjectContext((_SECURITY_SUBJECT_CONTEXT *)AccessState + 1);
  }
  return -1073741703;
}

Referenced by: