SepCopyObjectTypeList

NTSTATUS __stdcall SepCopyObjectTypeList(
        _IOBJECT_TYPE_LIST *ObjectTypeList,
        UINT64 ObjectTypeListLength,
        _IOBJECT_TYPE_LIST **NewObjectTypeList){
  int v4; 
  __int64 v6; 
  VOID **PoolWithTag; 
  char *v9; 
  signed __int64 v10; 
  __int128 v11; 

  *NewObjectTypeList = 0i64;
  v4 = ObjectTypeListLength;
  if( (_DWORD)ObjectTypeListLength )
  {
    v6 = (unsigned int)ObjectTypeListLength;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 48i64 * (unsigned int)ObjectTypeListLength, 1951360339i64);
    if( !PoolWithTag )
      return -1073741670;
    if( v4 )
    {
      v9 = (char *)PoolWithTag + 2;
      v10 = (char *)ObjectTypeList - (char *)PoolWithTag;
      do
      {
        *((_WORD *)v9 - 1) = *(_WORD *)&v9[v10 - 2];
        *(_WORD *)v9 = *(_WORD *)&v9[v10];
        *(_DWORD *)(v9 + 18) = *(_DWORD *)&v9[v10 + 18];
        v11 = *(_OWORD *)&v9[v10 + 2];
        *(_DWORD *)(v9 + 22) = 0;
        *(_DWORD *)(v9 + 26) = 0;
        *(_DWORD *)(v9 + 30) = 0;
        *(_QWORD *)(v9 + 38) = 0i64;
        *(_OWORD *)(v9 + 2) = v11;
        v9 += 48;
        --v6;
      }
      while( v6 );
    }
    *NewObjectTypeList = (_IOBJECT_TYPE_LIST *)PoolWithTag;
  }
  return 0;
}

Referenced by:

SeAccessCheckByTypeWithAdminlessChecks
SepAccessCheckAndAuditAlarmWithAdminlessChecks