NtSetInformationObject

NTSTATUS __stdcall NtSetInformationObject(
        PVOID Handle,
        OBJECT_INFORMATION_CLASS ObjectInformationClass,
        PVOID ObjectInformation,
        UINT64 ObjectInformationLength){
  int v5; 
  __int32 v6; 
  char v7; 
  __int32 v9; 
  KPROCESSOR_MODE v10; 
  unsigned int CurrentProcessSessionId; 
  struct _DMA_ADAPTER *v12; 
  struct _DMA_ADAPTER *v13; 
  struct _DMA_ADAPTER *v14; 
  _OBP_LOOKUP_CONTEXT *p_LookupContext; 
  KPROCESSOR_MODE v16; 
  PVOID Object; 
  PVOID v18; 
  struct _OBJECT_HANDLE_INFORMATION HandleInformation; 
  struct _OBJECT_HANDLE_INFORMATION v20; 
  _OBP_LOOKUP_CONTEXT LookupContext; 
  _OBP_LOOKUP_CONTEXT v22; 
  __int16 v23; 
  v23 = 0;
  v5 = -1073741821;
  v6 = ObjectInformationClass - 4;
  if( v6 )
  {
    v9 = v6 - 1;
    if( v9 )
    {
      if( v9 != 1 )
        return v5;
      v10 = *((_BYTE *)KeGetCurrentThread() + 562);
      if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v10) )
      {
        HandleInformation = 0i64;
        Object = 0i64;
        v5 = ObReferenceObjectByHandle(Handle, 0, ObpDirectoryObjectType, v10, &Object, &HandleInformation);
        if( v5 >= 0 )
        {
          CurrentProcessSessionId = PsGetCurrentProcessSessionId();
          LODWORD(v12) = MmGetSessionObjectById(CurrentProcessSessionId);
          v13 = v12;
          v14 = (struct _DMA_ADAPTER *)Object;
          if( !v12 )
          {
            v5 = -1073740715;
            goto LABEL_18;
          }
          *(&LookupContext.LockStateSignature + 1) = 0;
          memset(&LookupContext, 0, 32);
          LookupContext.LockStateSignature = -60876;
          ObpLockDirectoryExclusive(&LookupContext, (_OBJECT_DIRECTORY *)Object);
          if( v14[20].DmaOperations )
          {
            v5 = -1073741790;
            HalPutDmaAdapter(v13);
          }
          else
          {
            v14[20].DmaOperations = (_DMA_OPERATIONS *)v13;
          }
          p_LookupContext = &LookupContext;
LABEL_17:
          ObpUnlockDirectory((INT64)v14, (INT64)p_LookupContext);
LABEL_18:
          HalPutDmaAdapter(v14);
        }
        return v5;
      }
    }
    else
    {
      v16 = *((_BYTE *)KeGetCurrentThread() + 562);
      if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v16) )
      {
        v20 = 0i64;
        v18 = 0i64;
        v5 = ObReferenceObjectByHandle(Handle, 0, ObpDirectoryObjectType, v16, &v18, &v20);
        if( v5 < 0 )
          return v5;
        *(&v22.LockStateSignature + 1) = 0;
        memset(&v22, 0, 32);
        v22.LockStateSignature = -60876;
        v14 = (struct _DMA_ADAPTER *)v18;
        ObpLockDirectoryExclusive(&v22, (_OBJECT_DIRECTORY *)v18);
        *(_DWORD *)(&v14[21].Size + 1) = PsGetCurrentProcessSessionId();
        p_LookupContext = &v22;
        goto LABEL_17;
      }
    }
    return -1073741727;
  }
  if( (_DWORD)ObjectInformationLength == 2 )
  {
    v7 = *((_BYTE *)KeGetCurrentThread() + 562);
    if( v7
      && ((unsigned __int64)ObjectInformation + 2 > 0x7FFFFFFF0000i64
       || (char *)ObjectInformation + 2 < ObjectInformation) )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
    v23 = *(_WORD *)ObjectInformation;
    return ObSetHandleAttributes((unsigned __int64)Handle, &v23, v7);
  }
  return -1073741820;
}

Referenced by: