ObpSetObjectAuditInfo

NTSTATUS __stdcall ObpSetObjectAuditInfo(_OBJECT_HEADER *ObjectHeader, VOID *SecurityDescriptor){
  char v2; 
  char v4; 
  _QWORD *v7; 
  void *v8; 
  unsigned int v9; 
  VOID **PoolWithTag; 
  _ETHREAD *CurrentThread; 
  ULONG_PTR v12; 

  v4 = v2;
  if( !RtlValidSecurityDescriptor(*(VOID **)SecurityDescriptor) )
    return -1073741703;
  if( (ObjectHeader->InfoMask & 0x20) != 0 )
    v7 = (__int64 *)((char *)&ObjectHeader->PointerCount
                   - *((unsigned __int8 *)&dword_140C25D60 + (ObjectHeader->InfoMask & 0x3F)));
  else
    v7 = 0i64;
  if( v7 && !*v7 )
  {
    v8 = *(void **)SecurityDescriptor;
    if( v4 )
    {
      *(_QWORD *)SecurityDescriptor = 0i64;
    }
    else
    {
      v9 = RtlLengthSecurityDescriptor(*(_QWORD *)SecurityDescriptor);
      PoolWithTag = ExAllocatePoolWithTag(1ui64, v9, 1229021775i64);
      v8 = PoolWithTag;
      if( !PoolWithTag )
        return -1073741670;
      memmove(PoolWithTag, *(const VOID **)SecurityDescriptor, v9);
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&ObjectHeader->Lock, 0i64);
    v12 = (_DWORD)ObjectHeader + 16;
    if( *v7 )
    {
      ExReleasePushLockEx(v12, 0);
      KeLeaveCriticalRegion();
      ExFreePoolWithTag(v8, 0);
    }
    else
    {
      *v7 = v8;
      ExReleasePushLockEx(v12, 0);
      KeLeaveCriticalRegion();
    }
  }
  return 0;
}

Referenced by: