ObpCaptureBoundaryDescriptor

INT64 __fastcall ObpCaptureBoundaryDescriptor(__m128i *Src, CHAR **a2){
  __m128i *v4; 
  unsigned int v5; 
  char *v6; 
  UINT8 *PoolWithTag; 
  char v9; 
  __int64 v10; 
  unsigned __int64 v11; 
  char *v12; 
  int v13; 
  int v14; 
  _ETHREAD *CurrentThread; 
  void *PrimaryToken; 
  char *v17; 
  unsigned int v18; 
  unsigned int v19; 
  PVOID P; 
  size_t Size; 
  PVOID v22; 
  __m128i v23; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  PVOID TokenInformation; 
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  *a2 = 0i64;
  if( *((_BYTE *)KeGetCurrentThread() + 562) )
  {
    v4 = (__m128i *)0x7FFFFFFF0000i64;
    if( (unsigned __int64)Src < 0x7FFFFFFF0000i64 )
      v4 = Src;
    v23 = *v4;
    v5 = _mm_cvtsi128_si32(_mm_srli_si128(v23, 8));
    v23.m128i_i32[2] = v5;
    if( v5 - 16 > 0x7FEF )
      return 3221225485i64;
    if( v5 )
    {
      if( ((unsigned __int8)Src & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v6 = &Src->m128i_i8[v5];
      if( (unsigned __int64)v6 > 0x7FFFFFFF0000i64 || v6 < (char *)Src )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    v23 = *Src;
    v5 = v23.m128i_u32[2];
  }
  PoolWithTag = 0i64;
  LODWORD(TokenInformation) = 0;
  v9 = 0;
  Size = v5;
  v10 = v5;
  P = 0i64;
  v19 = 0;
  if( (v23.m128i_i8[12] & 1) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v9 = 1;
    SeCaptureSubjectContextEx(CurrentThread, *((_EPROCESS **)CurrentThread + 23), &SubjectContext);
    PrimaryToken = SubjectContext.PrimaryToken;
    if( SubjectContext.ClientToken )
      PrimaryToken = SubjectContext.ClientToken;
    SeQueryInformationToken(PrimaryToken, TokenIsAppContainer, &TokenInformation);
    if( (_DWORD)TokenInformation )
    {
      v13 = SeQueryInformationToken(PrimaryToken, TokenAppContainerSid, &P);
      if( v13 < 0 )
        goto LABEL_20;
      v19 = RtlLengthSid(*(PVOID *)P);
      v10 += ((v19 + 7i64) & 0xFFFFFFFFFFFFFFF8ui64) + 8;
    }
    v5 = v23.m128i_u32[2];
  }
  v11 = v10 + 48;
  if( v11 > 0xFFFFFFFF )
  {
    v13 = -1073741675;
    goto LABEL_20;
  }
  PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned int)v11, 0x534E624Fui64);
  v22 = PoolWithTag;
  if( !PoolWithTag )
  {
    v13 = -1073741670;
    goto LABEL_20;
  }
  *((_QWORD *)PoolWithTag + 3) = (unsigned int)v11 - 48i64;
  v12 = (char *)(PoolWithTag + 48);
  memmove(PoolWithTag + 48, (UINT8 *)Src, Size);
  if( P )
  {
    v17 = &v12[Size];
    if( &v12[Size] != (char *)((unsigned __int64)&v12[Size + 7] & 0xFFFFFFFFFFFFFFF8ui64) )
    {
LABEL_38:
      v13 = -1073741811;
      goto LABEL_20;
    }
    *(_DWORD *)v17 = 2;
    v18 = ((v19 + 7) & 0xFFFFFFF8) + 8;
    *((_DWORD *)v17 + 1) = v18;
    v5 += v18;
    ++v23.m128i_i32[1];
    memmove((UINT8 *)v17 + 8, *(UINT8 **)P, v19);
  }
  *((_DWORD *)PoolWithTag + 14) = v5;
  *((_DWORD *)PoolWithTag + 13) = v23.m128i_i32[1];
  v13 = RtlEnumerateBoundaryDescriptorEntries((_DWORD *)PoolWithTag + 12, 0i64, 0i64);
  if( v13 >= 0 && !ObpCheckDuplicateEntries((INT64)PoolWithTag) )
    goto LABEL_38;
  PoolWithTag[40] = 0;
  RtlEnumerateBoundaryDescriptorEntries(
    (_DWORD *)PoolWithTag + 12,
    (unsigned int(__fastcall *)(_DWORD *, __int64))ObpHashBoundaryFunction,
    (__int64)PoolWithTag);
  v14 = (3134165325u * (unsigned __int64)PoolWithTag[40]) >> 32;
  PoolWithTag[40] -= 37 * ((v14 + (((unsigned int)PoolWithTag[40] - v14) >> 1)) >> 5);
LABEL_20:
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v9 )
    SeReleaseSubjectContext(&SubjectContext);
  if( v13 < 0 )
  {
    if( PoolWithTag )
      ExFreePoolWithTag(PoolWithTag, 0x534E624Fu);
  }
  else
  {
    *a2 = (CHAR *)PoolWithTag;
  }
  return(unsigned int)v13;
}

Referenced by: