RtlIsUntrustedObject

NTSTATUS __stdcall RtlIsUntrustedObject(PVOID Handle, PVOID Object, UINT8 *UntrustedObject){
  char *PoolWithQuotaTag; 
  char v6; 
  NTSTATUS result; 
  NTSTATUS v8; 
  __int16 v9; 
  __int64 v10; 
  ACL *v11; 
  __int64 v12; 
  int v13; 
  int v14; 
  UINT64 LengthNeeded; 
  UINT8 *pIndex_4; 
  char SecurityDescriptor[128]; 
  LODWORD(LengthNeeded) = 0;
  PoolWithQuotaTag = SecurityDescriptor;
  pIndex_4 = UntrustedObject;
  *UntrustedObject = 1;
  if( Object )
  {
    if( !Handle )
      goto LABEL_3;
    return -1073741811;
  }
  if( !Handle )
    return -1073741811;
LABEL_3:
  v6 = 0;
  if( Handle )
  {
    result = ZwQuerySecurityObject(Handle, 0x10ui64, SecurityDescriptor, 0x7Cui64, &LengthNeeded);
    v8 = result;
    if( result >= 0 )
      goto LABEL_5;
    if( result == -1073741789 )
    {
      PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, (unsigned int)LengthNeeded, 0x62507452ui64);
      if( !PoolWithQuotaTag )
        return -1073741801;
      v6 = 1;
      v13 = ZwQuerySecurityObject(Handle, 0x10ui64, PoolWithQuotaTag, 0x7Cui64, &LengthNeeded);
      goto LABEL_24;
    }
  }
  else
  {
    result = ObQuerySecurityObject(Object, 0x10ui64, SecurityDescriptor, 0x7Cui64, &LengthNeeded);
    v8 = result;
    if( result >= 0 )
      goto LABEL_5;
    if( result == -1073741789 )
    {
      PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, (unsigned int)LengthNeeded, 0x62507452ui64);
      if( !PoolWithQuotaTag )
        return -1073741801;
      v6 = 1;
      v13 = ObQuerySecurityObject(Object, 0x10ui64, PoolWithQuotaTag, 0x7Cui64, &LengthNeeded);
LABEL_24:
      v8 = v13;
      if( v13 < 0 )
      {
LABEL_25:
        ExFreePoolWithTag(PoolWithQuotaTag, 0);
        return v8;
      }
LABEL_5:
      v9 = *((_WORD *)PoolWithQuotaTag + 1);
      if( (v9 & 0x10) != 0 )
      {
        if( v9 >= 0 )
        {
          v11 = (ACL *)*((_QWORD *)PoolWithQuotaTag + 3);
        }
        else
        {
          v10 = *((unsigned int *)PoolWithQuotaTag + 3);
          if( !(_DWORD)v10 )
            goto LABEL_12;
          v11 = (ACL *)&PoolWithQuotaTag[v10];
        }
        if( v11 )
        {
          HIDWORD(LengthNeeded) = 0;
          while( 1 )
          {
            LODWORD(v12) = RtlFindAceByType(v11, 0x11ui64, (UINT64 *)((char *)&LengthNeeded + 4));
            if( !v12 )
              break;
            if( (*(_BYTE *)(v12 + 1) & 8) == 0 )
            {
              v14 = *(unsigned __int8 *)(v12 + 9);
              if( !(_BYTE)v14 || *(_DWORD *)(v12 + 4i64 * (unsigned int)(v14 - 1) + 16) < 0x2000u )
                goto LABEL_13;
              break;
            }
          }
        }
      }
LABEL_12:
      *pIndex_4 = 0;
LABEL_13:
      if( !v6 )
        return v8;
      goto LABEL_25;
    }
  }
  return result;
}

Referenced by: