SepValidateReferencedCachedHandles

INT64 __fastcall SepValidateReferencedCachedHandles(INT64 a1, CHAR **a2, UINT64 a3, HANDLE *a4){
  unsigned int v4; 
  int v6; 
  int AppContainerSidType; 
  struct _DMA_ADAPTER *v9; 
  unsigned int v10; 
  CHAR *v11; 
  WCHAR v12; 
  int v13; 
  WCHAR v14; 
  UNICODE_STRING *v15; 
  NTSTATUS v16; 
  char *v17; 
  _OBJECT_TYPE *v18; 
  __int64 v19; 
  char *v20; 
  unsigned int v21; 
  WCHAR v23; 
  int v24; 
  WCHAR v25; 
  int v26; 
  WCHAR v27; 
  char v28; 
  int v29; 
  int v30; 
  unsigned int v31; 
  PVOID P; 
  PVOID Object[2]; 
  HANDLE *v34; 
  struct _UNICODE_STRING UnicodeString; 
  struct _UNICODE_STRING DestinationString; 
  char v37[8]; 
  struct _UNICODE_STRING v38; 
  char v39; 
  wchar_t pszDest[256]; 
  wchar_t SourceString[256]; 
  v4 = 0;
  v34 = a4;
  v31 = a3;
  v6 = *(_DWORD *)a2;
  v30 = 0;
  v28 = 0;
  AppContainerSidType = 0;
  v29 = 0;
  v9 = 0i64;
  P = 0i64;
  v10 = 0;
  Object[0] = 0i64;
  UnicodeString = 0i64;
  if( v6 )
  {
    if( v6 != 1 )
      goto LABEL_9;
    Object[0] = a2 + 1;
    RtlStringCchPrintfW(pszDest, 0x100ui64, (WCHAR *)L"\\Sessions\\%d");
    AppContainerSidType = v26;
    if( v26 < 0 )
      goto LABEL_34;
    RtlInitUnicodeString(&DestinationString, pszDest, v25);
    v37[0] = 1;
    v10 = 1;
    if( *(_DWORD *)(a1 + 120) != (unsigned int)RtlGetCurrentServiceSessionId() )
      goto LABEL_9;
    RtlInitUnicodeString(&v38, L"\\BaseNamedObjects", v27);
    v39 = 1;
  }
  else
  {
    AppContainerSidType = RtlGetAppContainerSidType(a2[1], &v29);
    if( AppContainerSidType < 0 )
      goto LABEL_34;
    v11 = a2[1];
    if( v29 == 2 )
    {
      AppContainerSidType = RtlConvertSidToUnicodeString(&UnicodeString, v11, 1u);
      if( AppContainerSidType < 0 )
        goto LABEL_34;
      v28 = 1;
    }
    else
    {
      RtlSubAuthoritySid(a2[1], 0xBui64);
      RtlSubAuthoritySid(v11, 0xAui64);
      RtlSubAuthoritySid(v11, 9ui64);
      RtlSubAuthoritySid(v11, 8ui64);
      RtlStringCchPrintfW(SourceString, 0x100ui64, (WCHAR *)L"%u-%u-%u-%u");
      v4 = 0;
      AppContainerSidType = v24;
      if( v24 < 0 )
        goto LABEL_34;
      RtlInitUnicodeString(&UnicodeString, SourceString, v23);
    }
    Object[0] = &UnicodeString;
    RtlStringCchPrintfW(pszDest, 0x100ui64, (WCHAR *)L"\\Sessions\\%d");
    AppContainerSidType = v13;
    if( v13 < 0 )
      goto LABEL_34;
    RtlInitUnicodeString(&DestinationString, pszDest, v12);
    v37[0] = 1;
    RtlInitUnicodeString(&v38, L"\\Device\\NamedPipe", v14);
    v39 = 0;
  }
  v10 = 2;
LABEL_9:
  if( !v31 )
    goto LABEL_34;
  v15 = (UNICODE_STRING *)Object[0];
  while( 1 )
  {
    if( v9 )
      HalPutDmaAdapter(v9);
    Object[0] = 0i64;
    v16 = ObReferenceObjectByHandle(*v34, 0, 0i64, 0, Object, 0i64);
    v9 = (struct _DMA_ADAPTER *)Object[0];
    AppContainerSidType = v16;
    if( v16 < 0 )
      goto LABEL_33;
    v17 = (char *)Object[0] - 48;
    v18 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *((unsigned __int8 *)Object[0] - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)(LOWORD(Object[0]) - 48) >> 8)];
    if( v18 != ObpDirectoryObjectType
      && v18 != ObpSymbolicLinkObjectType
      && (v18 != (_OBJECT_TYPE *)IoFileObjectType || *(_DWORD *)(*((_QWORD *)Object[0] + 1) + 72i64) != 17) )
    {
      break;
    }
    if( P )
    {
      ExFreePoolWithTag(P, 0);
      P = 0i64;
    }
    AppContainerSidType = SepQueryNameString(v9, (_OBJECT_NAME_INFORMATION **)&P);
    if( AppContainerSidType < 0 )
      goto LABEL_34;
    if( !P )
      break;
    if( !*((_WORD *)P + 1) )
      break;
    *(_OWORD *)Object = *(_OWORD *)P;
    if( !v10 )
      break;
    while( !(unsigned __int8)RtlPrefixUnicodeString((char *)&DestinationString + 24 * v4, (INT64 *)Object) )
    {
      if( ++v4 >= v10 )
        goto LABEL_53;
    }
    v19 = 3i64 * v4;
    v4 = 0;
    if( v37[8 * v19] )
    {
      if( (v17[26] & 2) != 0 )
        v20 = &v17[-*((unsigned __int8 *)ObpInfoMaskToOffset + (v17[26] & 3))];
      else
        v20 = 0i64;
      if( !v20 || !*((_WORD *)v20 + 5) )
        break;
      *(_OWORD *)Object = *(_OWORD *)(v20 + 8);
      if( !RtlEqualUnicodeString((UNICODE_STRING *)Object, v15, 1u) )
      {
        v21 = 0;
        while( !RtlEqualUnicodeString(
                   (UNICODE_STRING *)Object,
                   (UNICODE_STRING *)&AllowedCachedObjectNames[2 * v21],
                   1u) )
        {
          if( ++v21 >= 5 )
            goto LABEL_53;
        }
      }
    }
LABEL_33:
    ++v34;
    if( ++v30 >= v31 )
      goto LABEL_34;
  }
LABEL_53:
  AppContainerSidType = -1073741811;
LABEL_34:
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v9 )
    HalPutDmaAdapter(v9);
  if( v28 )
    RtlFreeAnsiString(&UnicodeString);
  return(unsigned int)AppContainerSidType;
}

Referenced by: