SepRmFetchGlobalSacl

NTSTATUS __stdcall SepRmFetchGlobalSacl(const _UNICODE_STRING *ObjectType, UINT64 *AclSize, UINT8 **ppSacl){
  __int64 v3; 
  UINT64 v7; 
  VOID **PoolWithTag; 
  UINT64 v9; 
  signed int v10; 
  UINT64 v11; 
  _WORD *v12; 
  __int16 v13; 
  _WORD *v14; 
  int v15; 
  VOID **v17; 
  VOID **v18; 
  UINT64 Length; 
  UINT64 Lengtha; 
  UINT64 NumberOfBytes; 
  VOID *pHandle; 

  v3 = ObjectType->Length;
  pHandle = 0i64;
  LODWORD(NumberOfBytes) = 0;
  v7 = v3 + 98;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v7, 1818448711i64);
  if( !PoolWithTag )
    goto LABEL_18;
  v9 = v7 >> 1;
  v10 = v9 == 0 ? 0xC000000D : 0;
  if( v9 )
  {
    v11 = v9;
    v12 = PoolWithTag;
    do
    {
      if( !(2147483646 - v9 + v11) )
        break;
      v13 = *(_WORD *)((char *)v12
                     + (char *)L"\\Registry\\Machine\\SECURITY\\Policy\\GlobalSaclName"
                     - (char *)PoolWithTag);
      if( !v13 )
        break;
      *v12++ = v13;
      --v11;
    }
    while( v11 );
    v14 = v12 - 1;
    if( v11 )
      v14 = v12;
    v10 = v11 == 0 ? 0x80000005 : 0;
    *v14 = 0;
  }
  if( v10 >= 0 )
    RtlStringCchCatNW((WCHAR *)PoolWithTag, v9, ObjectType->Buffer, (unsigned __int64)ObjectType->Length >> 1);
  v15 = SepRegOpenKey((WCHAR *)PoolWithTag, 0x201ui64, &pHandle);
  if( v15 >= 0 )
  {
    LODWORD(Length) = 0;
    v15 = ZwQueryValueKey(pHandle, &DefaultKey, KeyValuePartialInformation, 0i64, Length, &NumberOfBytes);
    if( ((int)(v15 + 0x80000000) < 0 || v15 == -1073741789) && (unsigned int)NumberOfBytes <= 0x1000B )
    {
      v15 = 0;
      if( (unsigned int)NumberOfBytes <= 0xC )
      {
        *(_DWORD *)AclSize = 0;
        *ppSacl = 0i64;
        goto LABEL_13;
      }
      v17 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1818448711i64);
      if( v17 )
      {
        LODWORD(Lengtha) = NumberOfBytes;
        v15 = ZwQueryValueKey(pHandle, &DefaultKey, KeyValuePartialInformation, v17, Lengtha, &NumberOfBytes);
        if( v15 >= 0 )
        {
          LODWORD(NumberOfBytes) = NumberOfBytes - 12;
          v18 = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1818448711i64);
          *ppSacl = (UINT8 *)v18;
          if( v18 )
          {
            memmove(v18, (char *)v17 + 12, NumberOfBytes);
            *(_DWORD *)AclSize = NumberOfBytes;
          }
          else
          {
            v15 = -1073741801;
          }
        }
        ExFreePoolWithTag(v17, 0);
        goto LABEL_13;
      }
LABEL_18:
      v15 = -1073741801;
    }
  }
LABEL_13:
  if( pHandle )
  {
    ZwClose((_HANDLE)pHandle);
    pHandle = 0i64;
  }
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return v15;
}

Referenced by: