SepAddTokenOriginClaim

NTSTATUS __stdcall SepAddTokenOriginClaim(VOID *OriginClaimData, UINT64 OriginClaimDataSize, VOID *Token){
  int appended; 
  _QWORD *v5; 
  _FADT *v6; 
  _UNICODE_STRING *v7; 
  __int16 v8; 
  UINT64 v9; 
  wchar_t *Pool2; 
  _FADT *v11; 
  _UNICODE_STRING Destination; 
  _TOKEN_SECURITY_ATTRIBUTES_INFORMATION pAttributes; 
  int v15; 
  _UNICODE_STRING *p_DestinationString; 
  __int128 v17; 
  _UNICODE_STRING SourceString; 
  _UNICODE_STRING DestinationString; 
  int v20; 
  int v21; 
  int v22; 
  __int128 *v23; 
  UINT16 pusResult; 
  _TOKEN_SECURITY_ATTRIBUTE_OPERATION pOperations; 

  *(_QWORD *)&SourceString.Length = 1966108i64;
  pusResult = 0;
  SourceString.Buffer = L"POLICYAPPID:
  appended = 0;
  v5 = 0i64;
  Destination = 0i64;
  v17 = 0i64;
  if( (_DWORD)OriginClaimDataSize == 536 )
  {
    v5 = OriginClaimData;
    if( !*(_DWORD *)OriginClaimData )
    {
      OriginClaimData = (VOID *)v17;
      goto LABEL_7;
    }
    DWORD2(v17) = 524;
  }
  else
  {
    DWORD2(v17) = OriginClaimDataSize;
  }
  *(_QWORD *)&v17 = OriginClaimData;
LABEL_7:
  if( !OriginClaimData )
    goto LABEL_9;
  pAttributes = 1;
  p_DestinationString = &DestinationString;
  v15 = 1;
  RtlInitUnicodeString(&DestinationString, L"SMARTLOCKER:
  v6 = (_FADT *)*((_QWORD *)Token + 97);
  v23 = &v17;
  v20 = 16;
  v22 = 1;
  v21 = 65;
  pOperations = TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE;
  appended = AuthzBasepSetSecurityAttributesToken(v6, &pOperations, &pAttributes);
  if( appended >= 0 )
  {
LABEL_9:
    if( v5 )
    {
      v7 = (_UNICODE_STRING *)v5[66];
      RtlInitUnicodeString(&Destination, 0i64);
      while( v7 )
      {
        appended = RtlUShortAdd(0x1Cu, v7[-2].Length, &pusResult);
        if( appended < 0 )
          break;
        appended = RtlUShortAdd(pusResult, v8 - 26, &pusResult);
        if( appended < 0 )
          break;
        v9 = pusResult;
        Destination.Length = 0;
        if( pusResult > Destination.MaximumLength )
        {
          if( Destination.Buffer )
            ExFreePoolWithTag(Destination.Buffer, 0x434F6553u);
          Destination.MaximumLength = v9;
          Pool2 = (wchar_t *)ExAllocatePool2(258i64, v9, 0x434F6553ui64);
          Destination.Buffer = Pool2;
          if( !Pool2 )
          {
            appended = -1073741670;
            goto LABEL_23;
          }
        }
        RtlCopyUnicodeString(&Destination, &SourceString);
        appended = RtlAppendUnicodeStringToString(&Destination, v7 - 2);
        if( appended < 0 )
          break;
        v11 = (_FADT *)*((_QWORD *)Token + 97);
        p_DestinationString = &DestinationString;
        pAttributes = 1;
        v23 = (__int128 *)&v7[-1];
        v15 = 1;
        DestinationString = Destination;
        v20 = 3;
        v22 = 1;
        v21 = 65;
        pOperations = TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE;
        appended = AuthzBasepSetSecurityAttributesToken(v11, &pOperations, &pAttributes);
        if( appended < 0 )
          break;
        v7 = *(_UNICODE_STRING **)&v7->Length;
      }
    }
  }
  Pool2 = Destination.Buffer;
LABEL_23:
  if( Pool2 )
    ExFreePoolWithTag(Pool2, 0x434F6553u);
  return appended;
}

Referenced by: