SeCaptureObjectTypeList

NTSTATUS __stdcall SeCaptureObjectTypeList(
        _OBJECT_TYPE_LIST *ObjectTypeList,
        UINT64 ObjectTypeListLength,
        INT8 RequestorMode,
        _IOBJECT_TYPE_LIST **CapturedObjectTypeList){
  unsigned int v5; 
  NTSTATUS v7; 
  VOID **PoolWithTag; 
  __int64 v9; 
  VOID **v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  __int64 Level; 
  VOID **v15; 
  GUID *ObjectType; 
  unsigned int v17; 
  __int64 v18; 
  int v20; 
  VOID **v21; 
  __int64 v22[4]; 

  v5 = ObjectTypeListLength;
  v22[0] = (__int64)CapturedObjectTypeList;
  v7 = 0;
  PoolWithTag = 0i64;
  *(_QWORD *)v22[0] = 0i64;
  if( RequestorMode != 1 )
    return -1073741822;
  if( (_DWORD)ObjectTypeListLength )
  {
    if( ObjectTypeList )
    {
      v9 = (unsigned int)ObjectTypeListLength;
      if( v9 * 16 )
      {
        if( ((unsigned __int8)ObjectTypeList & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        if( (unsigned __int64)&ObjectTypeList[v9] > 0x7FFFFFFF0000i64 || &ObjectTypeList[v9] < ObjectTypeList )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 48i64 * (unsigned int)ObjectTypeListLength, 1951360339i64);
      v21 = PoolWithTag;
      v10 = PoolWithTag;
      if( PoolWithTag )
      {
        v11 = 0i64;
        v20 = 0;
        while( (unsigned int)v11 < v5 )
        {
          v12 = (unsigned int)v11;
          v13 = v11;
          Level = ObjectTypeList[v13].Level;
          if( (unsigned int)Level > 4 )
            goto LABEL_27;
          v15 = &PoolWithTag[6 * v12];
          *(_DWORD *)v15 = (unsigned __int16)Level;
          ObjectType = ObjectTypeList[v13].ObjectType;
          if( ((unsigned __int8)ObjectType & 3) != 0 )
            ExRaiseDatatypeMisalignment();
          *(GUID *)((char *)v15 + 4) = *ObjectType;
          v15[3] = 0i64;
          *((_DWORD *)v15 + 8) = 0;
          v15[5] = 0i64;
          if( v20 )
          {
            v17 = Level;
            PoolWithTag = v21;
            if( (unsigned int)Level > (unsigned int)LOWORD(v21[6 * (unsigned int)(v20 - 1)]) + 1 || !(_WORD)Level )
              goto LABEL_27;
          }
          else
          {
            if( (_WORD)Level )
            {
              v7 = -1073741811;
              PoolWithTag = v21;
              break;
            }
            v17 = 0;
            PoolWithTag = v21;
          }
          v18 = 6 * v12;
          if( (_WORD)Level )
            HIDWORD(v10[v18 + 2]) = *((_DWORD *)v22 + v17 + 1);
          else
            HIDWORD(v10[v18 + 2]) = -1;
          *((_DWORD *)&v22[1] + Level) = v20;
          v11 = (unsigned int)++v20;
          v7 = 0;
        }
      }
      else
      {
        v7 = -1073741670;
      }
    }
    else
    {
LABEL_27:
      v7 = -1073741811;
    }
  }
  if( v7 < 0 )
  {
    if( PoolWithTag )
      ExFreePoolWithTag(PoolWithTag, 0);
  }
  else
  {
    *CapturedObjectTypeList = (_IOBJECT_TYPE_LIST *)PoolWithTag;
  }
  return v7;
}

Referenced by: