CmpSecurityMethod

INT64 __stdcall CmpSecurityMethod(
        VOID *Object,
        SECURITY_OPERATION_CODE OperationCode,
        UINT64 *SecurityInformation,
        VOID *SecurityDescriptor,
        UINT64 *CapturedLength,
        VOID **ObjectsSecurityDescriptor,
        POOL_TYPE PoolType,
        GENERIC_MAPPING *GenericMapping,
        INT8 Mode){
  GENERIC_MAPPING *v10; 
  void *v12; 
  VOID **v14; 
  char v15; 
  _ETHREAD *CurrentThread; 
  REG_NOTIFY_CLASS v17; 
  REG_NOTIFY_CLASS v18; 
  int v19; 
  unsigned int v20; 
  int KeySecurity; 
  _REG_NOTIFY_CLASS v22; 
  __int64 v23; 
  GENERIC_MAPPING *BugCheckParameter4; 
  INT64 a6[2]; 
  __int64 v27; 
  _SLIST_ENTRY *Argument[2]; 
  __int128 v29; 
  __int128 v30; 
  __int64 v31; 
  _LARGE_INTEGER TimeStamp[2]; 
  __int128 v33; 

  v10 = GenericMapping;
  v12 = (void *)(int)OperationCode;
  v14 = ObjectsSecurityDescriptor;
  *(_OWORD *)&TimeStamp[0].anonymous_0.LowPart = 0i64;
  v27 = 0i64;
  v33 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    EtwGetKernelTraceTimestamp(TimeStamp, 0x20000ui64);
    v14 = ObjectsSecurityDescriptor;
    v10 = GenericMapping;
  }
  a6[1] = (INT64)a6;
  v15 = 0;
  a6[0] = (INT64)a6;
  *(_OWORD *)Argument = 0i64;
  v31 = 0i64;
  v29 = 0i64;
  v30 = 0i64;
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) && Object )
    v27 = *((_QWORD *)Object + 1);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  if( dword_140C5083C )
  {
    if( !ExIsResourceAcquiredSharedLite((UINT64)&CmpRegistryLock, (INT64)v14, (INT64)v10) )
    {
      if( (_DWORD)v12 == 1 )
      {
        v17 = RegNtPreQueryKeySecurity;
        *((_QWORD *)&v29 + 1) = CapturedLength;
        v18 = RegNtPostQueryKeySecurity;
LABEL_8:
        *(_QWORD *)&v29 = SecurityDescriptor;
        Argument[1] = (_SLIST_ENTRY *)SecurityInformation;
        Argument[0] = (_SLIST_ENTRY *)Object;
        v19 = CmpCallCallBacksEx(v17, Argument, 0i64, 1, v18, (INT64)Object, (INT64)a6);
        v20 = v19;
        if( v19 < 0 )
        {
          if( v19 == -1073740541 )
            v20 = 0;
          goto LABEL_19;
        }
        v15 = 1;
        goto LABEL_10;
      }
      if( !(_DWORD)v12 )
      {
        v17 = RegNtPreSetKeySecurity;
        v18 = RegNtPostSetKeySecurity;
        goto LABEL_8;
      }
    }
LABEL_10:
    LODWORD(v14) = (_DWORD)ObjectsSecurityDescriptor;
  }
  if( (_DWORD)v12 == 1 )
  {
    KeySecurity = CmpQueryKeySecurity((CM_KEY_BODY *)Object, SecurityInformation, SecurityDescriptor, CapturedLength);
  }
  else if( (_DWORD)v12 )
  {
    if( (_DWORD)v12 == 2 )
      goto LABEL_14;
    if( (_DWORD)v12 != 3 )
      KeBugCheckEx(0x51u, (PVOID)5, (PVOID)1, *((PVOID *)Object + 1), v12);
    KeySecurity = CmpAssignKeySecurity((_CM_KEY_BODY *)Object, SecurityDescriptor);
  }
  else
  {
    LODWORD(BugCheckParameter4) = PoolType;
    KeySecurity = CmpSetKeySecurity(
                    (CM_KEY_BODY *)Object,
                    SecurityInformation,
                    SecurityDescriptor,
                    (POOL_TYPE)v14,
                    BugCheckParameter4);
  }
  v20 = KeySecurity;
  if( KeySecurity >= 0 )
LABEL_14:
    v20 = 0;
  if( !v15 )
    goto LABEL_19;
  if( (_DWORD)v12 == 1 )
  {
    v22 = RegNtPostQueryKeySecurity;
LABEL_18:
    v20 = CmPostCallbackNotificationEx(v22, (_SLIST_ENTRY *)Object, v20, (INT64)Argument, 0i64, (INT64)a6);
    goto LABEL_19;
  }
  if( !(_DWORD)v12 )
  {
    v22 = RegNtPostSetKeySecurity;
    goto LABEL_18;
  }
LABEL_19:
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    LOBYTE(v23) = ((_DWORD)v12 != 0) + 28;
    (*(void(__fastcall **)(__int64, _LARGE_INTEGER *, _QWORD, _QWORD, __int64, _QWORD))((char *)&NlsMbCodePageTag + 7))(
      v23,
      TimeStamp,
      v20,
      0i64,
      v27,
      0i64);
  }
  return v20;
}

Referenced by: