ObpCaptureBoundaryDescriptor

_KNOWN_CONTROLLER_TYPE *__stdcall ObpCaptureBoundaryDescriptor(_KNOWN_CONTROLLER_TYPE a1, _KNOWN_CONTROLLER_TYPE **a2){
  const VOID *v3; 
  __int64 v4; 
  unsigned int v5; 
  unsigned __int64 v6; 
  VOID **PoolWithTag; 
  char v9; 
  __int64 v10; 
  unsigned __int64 v11; 
  VOID **v12; 
  int v13; 
  int v14; 
  _ETHREAD *CurrentThread; 
  void *PrimaryToken; 
  _DWORD *v17; 
  unsigned int v18; 
  unsigned int v19; 
  PVOID P; 
  size_t Size[2]; 
  PVOID v22; 
  __m128i v23; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  VOID *TokenInformation; 

  v3 = *(const VOID **)&a1;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  *a2 = 0i64;
  if( KeGetCurrentThread()->PreviousMode )
  {
    v4 = 0x7FFFFFFF0000i64;
    if( *(_QWORD *)&a1 < 0x7FFFFFFF0000ui64 )
      v4 = *(_QWORD *)&a1;
    v23 = *(__m128i *)v4;
    v5 = _mm_cvtsi128_si32(_mm_srli_si128(v23, 8));
    v23.m128i_i32[2] = v5;
    if( v5 - 16 > 0x7FEF )
      return(_KNOWN_CONTROLLER_TYPE *)3221225485i64;
    if( v5 )
    {
      if( (a1 & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v6 = *(_QWORD *)&a1 + v5;
      if( v6 > 0x7FFFFFFF0000i64 || v6 < (unsigned __int64)v3 )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    v23 = **(__m128i **)&a1;
    v5 = v23.m128i_u32[2];
  }
  PoolWithTag = 0i64;
  LODWORD(TokenInformation) = 0;
  v9 = 0;
  *(_QWORD *)Size = v5;
  v10 = v5;
  P = 0i64;
  v19 = 0;
  if( (v23.m128i_i8[12] & 1) != 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v9 = 1;
    SeCaptureSubjectContextEx(CurrentThread, CurrentThread->Tcb.ApcState.Process, &SubjectContext);
    PrimaryToken = SubjectContext.PrimaryToken;
    if( SubjectContext.ClientToken )
      PrimaryToken = SubjectContext.ClientToken;
    SeQueryInformationToken(PrimaryToken, TokenIsAppContainer, &TokenInformation);
    if( (_DWORD)TokenInformation )
    {
      v13 = SeQueryInformationToken(PrimaryToken, TokenAppContainerSid, &P);
      if( v13 < 0 )
        goto LABEL_20;
      v19 = RtlLengthSid(*(_QWORD *)P);
      v10 += ((v19 + 7i64) & 0xFFFFFFFFFFFFFFF8ui64) + 8;
    }
    v5 = v23.m128i_u32[2];
  }
  v11 = v10 + 48;
  if( v11 > 0xFFFFFFFF )
  {
    v13 = -1073741675;
    goto LABEL_20;
  }
  PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)v11, 1397645903i64);
  v22 = PoolWithTag;
  if( !PoolWithTag )
  {
    v13 = -1073741670;
    goto LABEL_20;
  }
  PoolWithTag[3] = (VOID *)((unsigned int)v11 - 48i64);
  v12 = PoolWithTag + 6;
  memmove(PoolWithTag + 6, v3, Size[0]);
  if( P )
  {
    v17 = (_DWORD *)((char *)v12 + *(_QWORD *)Size);
    if( (VOID **)((char *)v12 + *(_QWORD *)Size) != (VOID **)(((unsigned __int64)v12 + *(_QWORD *)Size + 7) & 0xFFFFFFFFFFFFFFF8ui64) )
    {
LABEL_38:
      v13 = -1073741811;
      goto LABEL_20;
    }
    *v17 = 2;
    v18 = ((v19 + 7) & 0xFFFFFFF8) + 8;
    v17[1] = v18;
    v5 += v18;
    ++v23.m128i_i32[1];
    memmove(v17 + 2, *(const VOID **)P, v19);
  }
  *((_DWORD *)PoolWithTag + 14) = v5;
  *((_DWORD *)PoolWithTag + 13) = v23.m128i_i32[1];
  v13 = RtlEnumerateBoundaryDescriptorEntries((_DWORD *)PoolWithTag + 12, 0i64, 0i64);
  if( v13 >= 0 && !ObpCheckDuplicateEntries((__int64)PoolWithTag) )
    goto LABEL_38;
  *((_BYTE *)PoolWithTag + 40) = 0;
  RtlEnumerateBoundaryDescriptorEntries(
    (_DWORD *)PoolWithTag + 12,
    (unsigned int(__fastcall *)(_DWORD *, __int64))ObpHashBoundaryFunction,
    (__int64)PoolWithTag);
  v14 = (3134165325u * (unsigned __int64)*((unsigned __int8 *)PoolWithTag + 40)) >> 32;
  *((_BYTE *)PoolWithTag + 40) -= 37
                                * ((v14 + (((unsigned int)*((unsigned __int8 *)PoolWithTag + 40) - v14) >> 1)) >> 5);
LABEL_20:
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v9 )
    SeReleaseSubjectContext(&SubjectContext);
  if( v13 < 0 )
  {
    if( PoolWithTag )
      ExFreePoolWithTag(PoolWithTag, 0x534E624Fu);
  }
  else
  {
    *a2 = (_KNOWN_CONTROLLER_TYPE *)PoolWithTag;
  }
  return(_KNOWN_CONTROLLER_TYPE *)(unsigned int)v13;
}

Referenced by: