ObpCaptureObjectCreateInformation

INT64 __fastcall ObpCaptureObjectCreateInformation(
        INT64 ProbeMode,
        INT64 CreatorMode,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        _UNICODE_STRING *CapturedObjectName,
        _OBJECT_CREATE_INFORMATION *ObjectCreateInfo,
        INT64 UseLookaside,
        INT64 a7,
        INT64 a8){
  INT8 v9; 
  int Attributes; 
  _UNICODE_STRING *ObjectName; 
  void *SecurityDescriptor; 
  _SECURITY_QUALITY_OF_SERVICE *SecurityQualityOfService; 
  NTSTATUS v14; 
  void **p_SecurityDescriptor; 
  void *v17; 
  UINT64 Size; 
  int v19; 
  _SECURITY_QUALITY_OF_SERVICE *v20; 
  _UNICODE_STRING *v21; 
  void *v22; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v24; 
  v9 = ProbeMode;
  LODWORD(Size) = 0;
  *CapturedObjectName = 0i64;
  *(_OWORD *)&ObjectCreateInfo->Attributes = 0i64;
  *(_OWORD *)&ObjectCreateInfo->ProbeMode = 0i64;
  *(_OWORD *)&ObjectCreateInfo->SecurityDescriptor = 0i64;
  *(_OWORD *)&ObjectCreateInfo->SecurityQualityOfService.Length = 0i64;
  if( !ObjectAttributes )
    return 0i64;
  ObjectCreateInfo->ProbeMode = ProbeMode;
  if( (_BYTE)ProbeMode )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    if( *((_BYTE *)CurrentThread + 562) )
    {
      if( ((unsigned __int8)ObjectAttributes & 7) != 0 )
        goto LABEL_18;
    }
  }
  if( ObjectAttributes->Length != 48 )
  {
    v14 = -1073741811;
    HIDWORD(Size) = -1073741811;
    goto LABEL_33;
  }
  ObjectCreateInfo->RootDirectory = ObjectAttributes->RootDirectory;
  Attributes = ObjectAttributes->Attributes;
  v19 = Attributes;
  if( (_BYTE)CreatorMode )
  {
    Attributes &= ~0x200u;
    v19 = Attributes;
  }
  if( (Attributes & 0xFFFEE00D) != 0 )
  {
    v14 = -1073741811;
    HIDWORD(Size) = -1073741811;
    goto LABEL_33;
  }
  ObjectCreateInfo->Attributes = Attributes;
  ObjectName = ObjectAttributes->ObjectName;
  v21 = ObjectName;
  SecurityDescriptor = ObjectAttributes->SecurityDescriptor;
  v22 = SecurityDescriptor;
  SecurityQualityOfService = (_SECURITY_QUALITY_OF_SERVICE *)ObjectAttributes->SecurityQualityOfService;
  v20 = SecurityQualityOfService;
  if( SecurityQualityOfService )
  {
    if( !(_BYTE)ProbeMode )
    {
LABEL_14:
      ObjectCreateInfo->SecurityQualityOfService = *SecurityQualityOfService;
      goto LABEL_19;
    }
    v24 = (_ETHREAD *)KeGetCurrentThread();
    if( !*((_BYTE *)v24 + 562) || ((unsigned __int8)v20 & 3) == 0 )
    {
      SecurityQualityOfService = v20;
      SecurityDescriptor = v22;
      ObjectName = v21;
      goto LABEL_14;
    }
LABEL_18:
    ExRaiseDatatypeMisalignment();
  }
LABEL_19:
  if( SecurityDescriptor )
  {
    p_SecurityDescriptor = &ObjectCreateInfo->SecurityDescriptor;
    v14 = SeCaptureSecurityDescriptor(
            SecurityDescriptor,
            ProbeMode,
            PagedPool,
            1u,
            &ObjectCreateInfo->SecurityDescriptor);
    if( v14 < 0 )
    {
      *p_SecurityDescriptor = 0i64;
      goto LABEL_33;
    }
    SeComputeQuotaInformationSize(*p_SecurityDescriptor, &Size);
    ObjectCreateInfo->SecurityDescriptorCharge = Size;
  }
  if( !SecurityQualityOfService )
    goto LABEL_21;
  ObjectCreateInfo->SecurityQualityOfService.Length = 12;
  ObjectCreateInfo->SecurityQos = &ObjectCreateInfo->SecurityQualityOfService;
  if( ObjectCreateInfo->SecurityQualityOfService.ContextTrackingMode >= 2u )
  {
    v14 = -1073741811;
    goto LABEL_33;
  }
  if( ObjectCreateInfo->SecurityQualityOfService.ImpersonationLevel > (unsigned int)SecurityDelegation )
  {
    v14 = -1073741659;
  }
  else
  {
LABEL_21:
    if( ObjectName )
    {
      v14 = ObpCaptureObjectName(v9, ObjectName, CapturedObjectName, (unsigned int)UseLookaside);
      if( v14 >= 0 )
        return 0i64;
    }
    else
    {
      if( !ObjectCreateInfo->RootDirectory )
        return 0i64;
      v14 = -1073741773;
    }
  }
LABEL_33:
  v17 = ObjectCreateInfo->SecurityDescriptor;
  if( v17 )
  {
    SeReleaseSecurityDescriptor(v17, ObjectCreateInfo->ProbeMode, 1u);
    ObjectCreateInfo->SecurityDescriptor = 0i64;
  }
  return(unsigned int)v14;
}

Referenced by: