CmpQueryKeySecurity

VOID __stdcall CmpQueryKeySecurity(
        _CM_KEY_BODY *KeyBody,
        UINT64 *SecurityInformation,
        PVOID SecurityDescriptor,
        UINT64 *CapturedLength,
        PVOID *ObjectsSecurityDescriptor){
  char v5; 
  _ETHREAD *CurrentThread; 
  bool v11; 
  INT64 v12; 
  PVOID *v13; 
  PSECURITY_DESCRIPTOR ObjectsSecurityDescriptora; 
  __int128 v15; 
  __int128 v16; 
  v5 = 0;
  v15 = 0i64;
  ObjectsSecurityDescriptor = 0i64;
  v16 = 0i64;
  WORD1(v15) = -1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v11 = ExAcquireRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
  if( v11 )
  {
    CmpLockRegistry();
    v5 = 1;
    if( (int)CmpStartKcbStackForTopLayerKcb((INT64)&v15, (INT64)KeyBody->KeyControlBlock) < 0 )
      goto LABEL_9;
    CmpLockKcbStackShared((INT64)&v15);
    if( CmpPerformKeyBodyDeletionCheck((__int64)KeyBody, 0i64) < 0 )
      goto LABEL_8;
    if( *(_QWORD *)&KeyBody->Trans.0 || KeyBody->KtmUow )
    {
      if( CmpTransSearchAddTransFromKeyBody(KeyBody, (_CM_TRANS **)&ObjectsSecurityDescriptor) < 0 )
        goto LABEL_8;
      v13 = ObjectsSecurityDescriptor;
      if( CmpPerformKeyBodyDeletionCheck((__int64)KeyBody, (__int64)ObjectsSecurityDescriptor) < 0 )
        goto LABEL_8;
    }
    else
    {
      v13 = ObjectsSecurityDescriptor;
    }
    ObjectsSecurityDescriptora = &CmpGetSecurityCacheEntryForKcbStack((INT64)&v15, (INT64)v13, v12)[2];
    SeQuerySecurityDescriptorInfo(SecurityInformation, SecurityDescriptor, CapturedLength, &ObjectsSecurityDescriptora);
LABEL_8:
    CmpUnlockKcbStack((__int64)&v15);
    goto LABEL_9;
  }
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
LABEL_9:
  if( *((_QWORD *)&v16 + 1) )
    CmSiFreeMemory(*((PPRIVILEGE_SET *)&v16 + 1));
  if( v5 )
    CmpUnlockRegistry();
  if( v11 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&CmpShutdownRundown);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
}

Referenced by: