SepCopyObjectTypeList
NTSTATUS __stdcall SepCopyObjectTypeList(
_IOBJECT_TYPE_LIST *ObjectTypeList,
UINT64 ObjectTypeListLength,
_IOBJECT_TYPE_LIST **NewObjectTypeList){
int v4;
__int64 v6;
VOID **PoolWithTag;
char *v9;
signed __int64 v10;
__int128 v11;
*NewObjectTypeList = 0i64;
v4 = ObjectTypeListLength;
if( (_DWORD)ObjectTypeListLength )
{
v6 = (unsigned int)ObjectTypeListLength;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 48i64 * (unsigned int)ObjectTypeListLength, 1951360339i64);
if( !PoolWithTag )
return -1073741670;
if( v4 )
{
v9 = (char *)PoolWithTag + 2;
v10 = (char *)ObjectTypeList - (char *)PoolWithTag;
do
{
*((_WORD *)v9 - 1) = *(_WORD *)&v9[v10 - 2];
*(_WORD *)v9 = *(_WORD *)&v9[v10];
*(_DWORD *)(v9 + 18) = *(_DWORD *)&v9[v10 + 18];
v11 = *(_OWORD *)&v9[v10 + 2];
*(_DWORD *)(v9 + 22) = 0;
*(_DWORD *)(v9 + 26) = 0;
*(_DWORD *)(v9 + 30) = 0;
*(_QWORD *)(v9 + 38) = 0i64;
*(_OWORD *)(v9 + 2) = v11;
v9 += 48;
--v6;
}
while( v6 );
}
*NewObjectTypeList = (_IOBJECT_TYPE_LIST *)PoolWithTag;
}
return 0;
}Referenced by:
SeAccessCheckByTypeWithAdminlessChecks
SepAccessCheckAndAuditAlarmWithAdminlessChecks