SepVerifyDesktopAppPolicyOverrideCaller

CHAR __fastcall SepVerifyDesktopAppPolicyOverrideCaller(VOID *pToken){
  bool v2; 
  char PreviousMode; 
  _ADAPTER_OBJECT *v4; 
  _EPROCESS *Process; 
  signed __int64 Object; 
  signed __int64 v7; 
  _TOKEN_TYPE TokenType[2]; 
  _PS_PKG_CLAIM PkgClaim; 
  UINT64 PackageSize; 
  UINT64 v12; 
  _UNICODE_STRING v13; 
  _UNICODE_STRING String1_8; 
  _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel[4]; 
  WCHAR PackageFullName[128]; 
  WCHAR v17[128]; 

  PkgClaim = 0i64;
  TokenType[1] = 0;
  v12 = 256i64;
  PackageSize = 256i64;
  v2 = 0;
  LOBYTE(TokenType[0]) = 0;
  v13 = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  String1_8 = 0i64;
  if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
    return 1;
  if( RtlQueryPackageClaims(pToken, PackageFullName, &PackageSize, 0i64, 0i64, 0i64, 0i64, 0i64) >= 0 )
  {
    v4 = (_ADAPTER_OBJECT *)PsReferenceEffectiveToken(
                              (_ETHREAD *)KeGetCurrentThread(),
                              &TokenType[1],
                              (UINT8 *)TokenType,
                              ImpersonationLevel,
                              0i64);
    if( RtlQueryPackageClaims(v4, v17, &v12, 0i64, 0i64, 0i64, (PS_PKG_CLAIM *)&PkgClaim, 0i64) >= 0
      && (PkgClaim._bf_0 & 4) != 0 )
    {
      String1_8.Length = PackageSize - 2;
      String1_8.MaximumLength = PackageSize - 2;
      String1_8.Buffer = PackageFullName;
      v13.Length = v12 - 2;
      v13.MaximumLength = v12 - 2;
      v13.Buffer = v17;
      v2 = RtlCompareUnicodeString(&String1_8, &v13, 0) == 0;
    }
    if( v4 )
    {
      if( TokenType[1] == TokenPrimary )
      {
        Process = KeGetCurrentThread()->ApcState.Process;
        _m_prefetchw(&Process->Token);
        Object = (signed __int64)Process->Token.Object;
        while( ((unsigned __int64)v4 ^ Object) < 0xF )
        {
          v7 = Object;
          Object = _InterlockedCompareExchange64((volatile signed __int64 *)&Process->Token, Object + 1, Object);
          if( v7 == Object )
            return v2;
        }
        HalPutDmaAdapter(v4);
      }
      else
      {
        ObfDereferenceObjectWithTag(v4, 0x746C6644ui64);
      }
    }
  }
  return v2;
}

Referenced by:

No references.