PiUEventApplyAdditionalFilters

UINT8 __fastcall PiUEventApplyAdditionalFilters(__int64 a1, __int64 a2){
  int v2; 
  UINT8 v3; 
  int v6; 
  int v7; 
  int v8; 
  _SECURITY_SUBJECT_CONTEXT *v9; 
  PNP_OBJECT_TYPE v10; 
  WCHAR *v11; 
  NTSTATUS v12; 
  int v14; 
  int v15; 
  int v16; 
  VOID *v17; 
  VOID *ClientToken; 
  UINT8 IsServiceSession[4]; 
  UINT64 SessionId; 
  int v21; 
  int v22; 
  int v23; 

  v2 = *(_DWORD *)(a1 + 88);
  v3 = 1;
  IsServiceSession[0] = 1;
  v6 = v2 - 1;
  if( !v6 )
  {
LABEL_4:
    v9 = (_SECURITY_SUBJECT_CONTEXT *)(a2 + 56);
    v10 = 1;
    v11 = (WCHAR *)(a1 + 120);
    goto LABEL_5;
  }
  v7 = v6 - 1;
  if( v7 )
  {
    v8 = v7 - 1;
    if( v8 )
    {
      v14 = v8 - 1;
      if( v14 )
      {
        v15 = v14 - 5;
        if( v15 )
        {
          v16 = v15 - 1;
          if( v16 )
          {
            if( v16 != 1 )
              return v3;
          }
        }
      }
    }
    goto LABEL_4;
  }
  v9 = (_SECURITY_SUBJECT_CONTEXT *)(a2 + 56);
  v10 = 3;
  v11 = (WCHAR *)(a1 + 136);
LABEL_5:
  v12 = PiPnpRtlApplyMandatoryFilters(*(&stru_140CF2E80 + 607), v11, v10, 0i64, v9, IsServiceSession);
  if( v12 >= 0 )
    return IsServiceSession[0];
  if( v12 != -1073741772 )
    return 0;
  v17 = *(VOID **)(a1 + 48);
  if( !v17
    || (IsServiceSession[0] = 0,
        v21 = 0x20000,
        v22 = 0x20000,
        HIDWORD(SessionId) = 131073,
        v23 = 983041,
        PiAuVerifyAccessToObject(1ui64, v17, (_GENERIC_MAPPING *)((char *)&SessionId + 4), v9, IsServiceSession) < 0)
    || (v3 = IsServiceSession[0]) != 0 )
  {
    if( *(_DWORD *)(a1 + 60) != -1 )
    {
      LODWORD(SessionId) = 0;
      ClientToken = v9->ClientToken;
      IsServiceSession[0] = 0;
      if( !ClientToken )
        ClientToken = *(VOID **)(a2 + 72);
      SeQuerySessionIdTokenEx(ClientToken, &SessionId, IsServiceSession);
      if( !IsServiceSession[0] && (_DWORD)SessionId != *(_DWORD *)(a1 + 60) )
        return 0;
    }
  }
  return v3;
}

Referenced by: