ObLogSecurityDescriptor

NTSTATUS __stdcall ObLogSecurityDescriptor(
        VOID *InputSecurityDescriptor,
        VOID **OutputSecurityDescriptor,
        UINT64 RefBias){
  unsigned __int64 v4; 
  char *v5; 
  char *v6; 
  unsigned __int64 v7; 
  _ETHREAD *CurrentThread; 
  CHAR *CacheEntry; 
  _EX_PUSH_LOCK *v10; 
  volatile signed __int64 *p_bf_0; 
  signed __int64 v12; 
  unsigned int Size; 
  unsigned int a4; 

  a4 = RefBias;
  Size = RtlLengthSecurityDescriptor((INT64)InputSecurityDescriptor);
  v4 = 0i64;
  v5 = (char *)InputSecurityDescriptor;
  v6 = (char *)InputSecurityDescriptor + (Size & 0xFFFFFFF8);
  if( InputSecurityDescriptor < v6 )
  {
    do
    {
      v7 = *(_QWORD *)v5 ^ v4;
      v5 += 16;
      v4 = __ROL8__(v7, 3);
    }
    while( v5 < v6 );
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  CacheEntry = 0i64;
  v10 = (_EX_PUSH_LOCK *)((char *)&ObsSecurityDescriptorCache + 16 * (unsigned __int8)v4);
  --CurrentThread->Tcb.KernelApcDisable;
LABEL_4:
  p_bf_0 = &v10[1]._bf_0;
  ExAcquirePushLockSharedEx(v10, 0i64);
  while( 1 )
  {
    v12 = *p_bf_0;
    if( *p_bf_0 )
      break;
LABEL_9:
    if( !CacheEntry )
    {
      if( _InterlockedCompareExchange64(&v10->_bf_0, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v10);
      KeAbPostRelease(v10);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
      CacheEntry = ObpCreateCacheEntry(InputSecurityDescriptor, Size, v4, a4);
      if( !CacheEntry )
        return -1073741670;
      --CurrentThread->Tcb.KernelApcDisable;
      goto LABEL_4;
    }
    *(_QWORD *)CacheEntry = v12;
    p_bf_0 = (volatile signed __int64 *)_InterlockedCompareExchange64(p_bf_0, (signed __int64)CacheEntry, v12);
    if( (volatile signed __int64 *)v12 == p_bf_0 )
    {
      if( _InterlockedCompareExchange64(&v10->_bf_0, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v10);
      KeAbPostRelease(v10);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
      *OutputSecurityDescriptor = CacheEntry + 32;
      return 0;
    }
  }
  while( *(_QWORD *)(v12 + 16) != v4 )
  {
    if( *(_QWORD *)(v12 + 16) > v4 )
      goto LABEL_9;
LABEL_8:
    p_bf_0 = (volatile signed __int64 *)v12;
    v12 = *(_QWORD *)v12;
    if( !v12 )
      goto LABEL_9;
  }
  if( *(_DWORD *)(v12 + 24) != Size || memcmp(InputSecurityDescriptor, (const VOID *)(v12 + 32), Size) )
    goto LABEL_8;
  if( _InterlockedExchangeAdd64((volatile signed __int64 *)(v12 + 8), a4) <= 0 )
    __fastfail(0xEu);
  if( _InterlockedCompareExchange64(&v10->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(v10);
  KeAbPostRelease(v10);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  *OutputSecurityDescriptor = (VOID *)(v12 + 32);
  if( CacheEntry )
    ExFreePoolWithTag(CacheEntry, 0x6353624Fu);
  return 0;
}

Referenced by: