SepVerifyDesktopAppxImage

INT64 __fastcall SepVerifyDesktopAppxImage(
        _EPROCESS *Process,
        _TOKEN *Token,
        INT64 VerifyTLAce,
        UINT8 *PackageVerified){
  char v6; 
  char *v7; 
  int v8; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *TrustLabelAce; 
  int v10; 
  int SecurityObject; 
  char *PoolWithTag; 
  char PackageNameVerified[4]; 
  char NumberOfBytes[12]; 
  char SecurityDescriptor[512]; 
  v6 = VerifyTLAce;
  *PackageVerified = 0;
  v7 = 0i64;
  v8 = *((_DWORD *)Process + 543);
  TrustLabelAce = 0i64;
  *(_QWORD *)&NumberOfBytes[4] = 0i64;
  PackageNameVerified[0] = 0;
  if( (v8 & 1) != 0 )
    return 0;
  v10 = PsReferenceProcessFilePointer((struct _EX_RUNDOWN_REF *)Process, (unsigned __int64 *)&NumberOfBytes[4]);
  if( v10 >= 0 )
  {
    *(_DWORD *)NumberOfBytes = 512;
    v7 = SecurityDescriptor;
    v10 = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    if( v10 >= 0 )
    {
      SecurityObject = ObQuerySecurityObject(
                         *(VOID **)&NumberOfBytes[4],
                         0x84ui64,
                         SecurityDescriptor,
                         0x200ui64,
                         (UINT64 *)NumberOfBytes);
      if( SecurityObject == -1073741789 )
      {
        PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, *(unsigned int *)NumberOfBytes, 0x20206553ui64);
        v7 = PoolWithTag;
        if( !PoolWithTag )
        {
          v10 = -1073741801;
          goto LABEL_23;
        }
        v10 = RtlCreateSecurityDescriptor(PoolWithTag, 1ui64);
        if( v10 < 0 )
          goto LABEL_23;
        SecurityObject = ObQuerySecurityObject(
                           *(VOID **)&NumberOfBytes[4],
                           0x84ui64,
                           v7,
                           *(unsigned int *)NumberOfBytes,
                           (UINT64 *)NumberOfBytes);
      }
      if( SecurityObject < 0 )
      {
        v10 = 0;
        goto LABEL_23;
      }
      if( !v7 )
      {
        v10 = -1073739509;
        goto LABEL_23;
      }
      v10 = SepVerifyDesktopAppxPackageName(Token, v7, (UINT8 *)PackageNameVerified);
      if( v10 >= 0 && v6 == 1 )
        TrustLabelAce = SeGetTrustLabelAce(v7);
      if( PackageNameVerified[0] != 1 )
        goto LABEL_23;
      if( v6 == 1 )
      {
        if( TrustLabelAce )
          goto LABEL_22;
        v10 = -1073740702;
      }
      if( v6 )
        goto LABEL_23;
LABEL_22:
      *PackageVerified = 1;
    }
  }
LABEL_23:
  if( *(_QWORD *)&NumberOfBytes[4] )
    ObfDereferenceObjectWithTag(*(PVOID *)&NumberOfBytes[4], 0x746C6644ui64);
  if( v7 && v7 != SecurityDescriptor )
    ExFreePoolWithTag(v7, 0);
  return(unsigned int)v10;
}

Referenced by: