ObpSetObjectAuditInfo

INT64 __fastcall ObpSetObjectAuditInfo(INT64 a1, VOID **a2, CHAR a3){
  _QWORD *v7; 
  void *v8; 
  UINT64 v9; 
  UINT8 *PoolWithTag; 
  _ETHREAD *CurrentThread; 
  UINT64 v12; 
  if( !RtlValidSecurityDescriptor(*a2) )
    return 3221225593i64;
  if( (*(_BYTE *)(a1 + 26) & 0x20) != 0 )
    v7 = (_QWORD *)(a1 - *((unsigned __int8 *)ObpInfoMaskToOffset + (*(_BYTE *)(a1 + 26) & 0x3F)));
  else
    v7 = 0i64;
  if( v7 && !*v7 )
  {
    v8 = *a2;
    if( a3 )
    {
      *a2 = 0i64;
    }
    else
    {
      v9 = (unsigned int)RtlLengthSecurityDescriptor(*a2);
      PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v9, 0x4941624Fui64);
      v8 = PoolWithTag;
      if( !PoolWithTag )
        return 3221225626i64;
      memmove(PoolWithTag, (UINT8 *)*a2, v9);
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx(a1 + 16, 0i64);
    v12 = a1 + 16;
    if( *v7 )
    {
      ExReleasePushLockEx(v12, 0i64);
      KeLeaveCriticalRegion();
      ExFreePoolWithTag(v8, 0);
    }
    else
    {
      *v7 = v8;
      ExReleasePushLockEx(v12, 0i64);
      KeLeaveCriticalRegion();
    }
  }
  return 0i64;
}

Referenced by: