NtSetSecurityObject

NTSTATUS __stdcall NtSetSecurityObject(PVOID Handle, UINT64 SecurityInformation, PVOID SecurityDescriptor){
  unsigned int v4; 
  int v5; 
  int v6; 
  ACCESS_MASK v7; 
  INT8 v8; 
  HANDLE v9; 
  int SecurityDescriptorInfo; 
  NTSTATUS v11; 
  struct _DMA_ADAPTER *v12; 
  PVOID v13; 
  unsigned int v14; 
  PVOID NewSecurityDescriptor; 
  PVOID OldSecurityDescriptorScope; 
  PVOID v17; 
  int v19; 
  int SaclSecurityDescriptor; 
  char v21; 
  UINT64 v22; 
  VOID *OldSecurityDescriptorAudit; 
  VOID *OldSecurityDescriptorAttribute; 
  char SaclDefaulted[4]; 
  ACCESS_MASK DesiredAccess; 
  PVOID SecurityDescriptora; 
  PVOID v28; 
  PVOID OutputSecurityDescriptor; 
  PVOID Object; 
  PVOID P; 
  PVOID v32; 
  struct _OBJECT_HANDLE_INFORMATION OldSecurityDescriptorDaclOwner; 
  __int64 v34; 
  PACL Sacl; 
  unsigned int SaclPresent; 
  INT8 RequestorMode; 
  OutputSecurityDescriptor = 0i64;
  v4 = SecurityInformation;
  DesiredAccess = 0;
  OldSecurityDescriptorDaclOwner = 0i64;
  v28 = 0i64;
  SecurityDescriptora = 0i64;
  P = 0i64;
  v32 = 0i64;
  if( !SecurityDescriptor )
    return -1073741819;
  v5 = SecurityInformation & 0x80;
  v6 = v4 & 0x100;
  if( (v4 & 0x10000) != 0 )
  {
    v19 = v4 | 0x1FF;
    v4 = v4 & 0xFFFFFE00 | 0x17F;
    if( v5 )
      v4 = v19;
    if( !v6 )
      v4 &= ~0x100u;
  }
  SeSetSecurityAccessMask(v4, (UINT64 *)&DesiredAccess);
  v7 = DesiredAccess;
  Object = 0i64;
  v8 = *((_BYTE *)KeGetCurrentThread() + 562);
  RequestorMode = v8;
  SecurityDescriptorInfo = ObReferenceObjectByHandle(
                             v9,
                             DesiredAccess,
                             0i64,
                             v8,
                             &Object,
                             &OldSecurityDescriptorDaclOwner);
  if( SecurityDescriptorInfo < 0 )
    return SecurityDescriptorInfo;
  v11 = SeCaptureSecurityDescriptor(SecurityDescriptor, v8, PagedPool, 1u, &OutputSecurityDescriptor);
  v12 = (struct _DMA_ADAPTER *)Object;
  SecurityDescriptorInfo = v11;
  if( v11 < 0 )
  {
LABEL_32:
    HalPutDmaAdapter(v12);
    return SecurityDescriptorInfo;
  }
  v13 = OutputSecurityDescriptor;
  v14 = v4 & 0xFFFFFE07;
  if( (v4 & 0x10000) == 0 || (*((_WORD *)OutputSecurityDescriptor + 1) & 0x10) != 0 )
    v14 = v4;
  if( ((v14 & 1) == 0 || *((_DWORD *)OutputSecurityDescriptor + 1))
    && ((v14 & 2) == 0 || *((_DWORD *)OutputSecurityDescriptor + 2)) )
  {
    if( (OldSecurityDescriptorDaclOwner.HandleAttributes & 4) == 0 )
      v7 &= 0xFFF3FFFF;
    if( !v7 )
      goto LABEL_12;
    SecurityDescriptorInfo = ObpAllocateAndQuerySecurityDescriptorInfo(Object, 8ui64, 0i64);
    if( SecurityDescriptorInfo < 0 )
    {
      OldSecurityDescriptorScope = v28;
      NewSecurityDescriptor = SecurityDescriptora;
LABEL_27:
      if( NewSecurityDescriptor )
        ExFreePoolWithTag(NewSecurityDescriptor, 0);
      if( OldSecurityDescriptorScope )
        ExFreePoolWithTag(OldSecurityDescriptorScope, 0);
      SeReleaseSecurityDescriptor(v13, RequestorMode, 1u);
      goto LABEL_32;
    }
    if( (v7 & 0xFEFFFFFF) != 0 )
    {
      NewSecurityDescriptor = SecurityDescriptora;
      LOBYTE(SaclPresent) = 0;
      SaclSecurityDescriptor = RtlGetSaclSecurityDescriptor(
                                 SecurityDescriptora,
                                 (UINT8 *)&SaclPresent,
                                 &Sacl,
                                 (UINT8 *)SaclDefaulted);
      SecurityDescriptorInfo = SaclSecurityDescriptor;
      v21 = SaclPresent;
      if( !(_BYTE)SaclPresent )
      {
        v34 = 0i64;
        v21 = (unsigned int)SepRmGlobalSaclFind(
                              &v34,
                              0i64,
                              (const UNICODE_STRING *)(ObTypeIndexTable[(unsigned __int8)(ObHeaderCookie ^ LOBYTE(v12[-2].DmaOperations) ^ ((unsigned __int16)((_WORD)v12 - 48) >> 8))]
                                                     + 16),
                              1) != -1073741772;
      }
      if( SecurityDescriptorInfo < 0 )
      {
LABEL_63:
        OldSecurityDescriptorScope = v28;
        goto LABEL_27;
      }
      if( v21 )
      {
        v22 = ((v7 & 0x80000) != 0 ? v14 & 0x13 : 0) | 4;
        if( (v7 & 0x40000) == 0 )
          v22 = (v7 & 0x80000) != 0 ? v14 & 0x13 : 0;
        SecurityDescriptorInfo = ObpAllocateAndQuerySecurityDescriptorInfo(v12, v22, 0i64);
      }
      else
      {
        v7 &= 0xFFF3FFFF;
      }
    }
    else
    {
LABEL_12:
      NewSecurityDescriptor = SecurityDescriptora;
    }
    if( SecurityDescriptorInfo >= 0 )
    {
      if( (v14 & 0x40) != 0
        && ((POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v12[-2].DmaOperations) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v12 - 48) >> 8)] != IoFileObjectType
         || (HIDWORD(v12->DmaOperations->FreeAdapterChannel) & 0x10) == 0) )
      {
        SecurityDescriptorInfo = ObpAllocateAndQuerySecurityDescriptorInfo(v12, 0x40ui64, 0i64);
      }
      OldSecurityDescriptorScope = v28;
      if( SecurityDescriptorInfo < 0 )
        goto LABEL_21;
      SaclPresent = v14 & 0x20;
      if( (v14 & 0x20) != 0
        && ((POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v12[-2].DmaOperations) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v12 - 48) >> 8)] != IoFileObjectType
         || (HIDWORD(v12->DmaOperations->FreeAdapterChannel) & 0x10) == 0) )
      {
        SecurityDescriptorInfo = ObpAllocateAndQuerySecurityDescriptorInfo(v12, 0x20ui64, 0i64);
      }
      if( SecurityDescriptorInfo >= 0
        && (SecurityDescriptorInfo = ObSetSecurityObjectByPointer(v12, v14, v13), SecurityDescriptorInfo >= 0)
        && (v7 || SaclPresent) )
      {
        v17 = P;
        LODWORD(OldSecurityDescriptorAttribute) = v14;
        LODWORD(OldSecurityDescriptorAudit) = v7;
        SeSecurityDescriptorChangedAuditAlarm(
          0i64,
          (UNICODE_STRING *)v12,
          (VOID *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v12[-2].DmaOperations) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v12 - 48) >> 8)]
                 + 16),
          0i64,
          (UINT64)Handle,
          0i64,
          OldSecurityDescriptorAudit,
          OldSecurityDescriptorAttribute,
          OldSecurityDescriptorScope,
          NewSecurityDescriptor);
      }
      else
      {
LABEL_21:
        v17 = P;
      }
      if( v32 )
        ExFreePoolWithTag(v32, 0);
      if( v17 )
        ExFreePoolWithTag(v17, 0);
      v13 = OutputSecurityDescriptor;
      goto LABEL_27;
    }
    goto LABEL_63;
  }
  SeReleaseSecurityDescriptor(OutputSecurityDescriptor, v8, 1u);
  HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  return -1073741703;
}

Referenced by: