SepNormalAccessCheck
INT64 __fastcall SepNormalAccessCheck(
INT64 rcx0,
INT64 rdx0,
VOID *a3,
INT64 a4,
INT64 a5,
INT64 *a6,
VOID *PrincipalSelfSid,
UINT64 a2,
INT64 a1,
INT64 a10,
CHAR a11,
UINT8 TokenIsOwner,
INT64 a13,
CHAR a14){
__int64 v14;
unsigned int v15;
int v16;
INT64 result;
__int64 *v18;
int v19;
int v20;
_DWORD *v21;
__int64 v22;
CHAR v23;
INT64 v24;
void *v25;
char v26;
int v27;
__int64 v28;
__int64 *v29;
unsigned __int8 *v30;
int v31;
unsigned __int8 v32;
__int64 v33;
unsigned int v34;
unsigned __int64 v35;
int v36;
__int64 v37;
int v38;
__int64 v39;
int v40;
unsigned int v41;
__int64 v42;
__int64 v43;
_DWORD *v44;
int v45;
unsigned __int16 v46;
unsigned int v47;
_QWORD *v48;
__int64 v49;
__int64 v50;
__int64 v51;
UINT64 v52;
UINT64 v53;
__int64 v54;
unsigned int v55;
int v56;
_DWORD *v57;
_DWORD *v58;
UINT8 *PackageMatched;
UINT *GrantedAccess;
unsigned int Data;
int Data_4;
unsigned int v63;
unsigned int DesiredAccess;
unsigned int DesiredAccess_4;
int v66;
int v67;
unsigned int v68;
int v69;
int v70;
__int64 v71;
__int64 v72;
unsigned __int8 v75;
__int64 v76;
v14 = 0i64;
v15 = a2;
v16 = *(_DWORD *)(rdx0 + 200) & 0x2000;
result = *(unsigned __int16 *)(a4 + 4);
v18 = (__int64 *)rdx0;
v19 = rcx0;
v63 = 0;
v20 = 0;
Data_4 = 0;
v67 = -1;
v68 = result;
if( (_DWORD)a2 )
{
v21 = (_DWORD *)(a1 + 24);
v22 = (unsigned int)a2;
do
{
*v21 = v19;
v21 += 12;
--v22;
}
while( v22 );
result = v68;
}
v23 = a11;
if( !v16 && !a11 )
{
v20 = v19 | *(_DWORD *)a13;
Data_4 = v20;
}
DesiredAccess = v20;
v24 = a4 + 8;
Data = 0;
if( !(_DWORD)result )
return result;
v25 = PrincipalSelfSid;
do
{
result = *(unsigned int *)(a1 + 24);
if( !(_DWORD)result && !v20 )
return result;
if( (*(_BYTE *)(v24 + 1) & 8) != 0 )
goto LABEL_34;
if( (_DWORD)result )
goto LABEL_11;
if( *(_BYTE *)v24 )
{
if( *(_BYTE *)v24 != 9 )
goto LABEL_34;
LABEL_11:
v26 = *(_BYTE *)v24;
if( !*(_BYTE *)v24 )
goto LABEL_12;
switch( v26 )
{
case 5:
v56 = *(_DWORD *)(v24 + 8);
v57 = (_DWORD *)(v24 + 12);
if( (v56 & 1) == 0 )
v57 = 0i64;
if( v57 )
{
if( !(_DWORD)a10 )
goto LABEL_34;
if( !SepSidInToken(
v18,
v25,
(PVOID)(v24 + ((8i64 * (v56 & 2)) | 0xC) + 16i64 * (v56 & 1)),
0,
v23,
TokenIsOwner)
|| !AuthzBasepObjectInTypeList(v57, a1, v15, &v63) )
{
goto LABEL_32;
}
v52 = Data;
v53 = v63;
LODWORD(GrantedAccess) = 0;
LODWORD(PackageMatched) = *(_DWORD *)(v24 + 4);
LABEL_87:
AuthzBasepAddAccessTypeList(a1, v15, v53, v52, (INT64)PackageMatched, (INT64)GrantedAccess);
goto LABEL_32;
}
if( !SepSidInToken(
v18,
v25,
(PVOID)(v24 + ((8i64 * (v56 & 2)) | 0xC) + 16i64 * (v56 & 1)),
0,
v23,
TokenIsOwner) )
goto LABEL_32;
v40 = *(_DWORD *)(v24 + 4);
if( v15 == 1 )
{
*(_DWORD *)(a1 + 24) &= ~v40;
goto LABEL_32;
}
break;
case 4:
if( !SepSidInToken(
v18,
v25,
(PVOID)(v24 + 4 * (*(unsigned __int8 *)(v24 + 13) + 5i64)),
0,
v23,
TokenIsOwner)
|| !SepSidInToken(a3, 0i64, (PVOID)(v24 + 12), 0, v23, TokenIsOwner) )
{
goto LABEL_32;
}
v40 = *(_DWORD *)(v24 + 4);
if( v15 == 1 )
{
*(_DWORD *)(a1 + 24) &= ~v40;
goto LABEL_32;
}
break;
case 1:
if( !SepSidInToken(v18, v25, (PVOID)(v24 + 8), 1u, v23, TokenIsOwner) )
goto LABEL_32;
result = *(unsigned int *)(v24 + 4);
if( ((unsigned int)result & *(_DWORD *)(a1 + 24)) == 0 )
goto LABEL_32;
return result;
case 6:
if( !SepSidInToken(
v18,
v25,
(PVOID)(v24 + ((8i64 * (*(_DWORD *)(v24 + 8) & 2)) | 0xC) + 16i64 * (*(_DWORD *)(v24 + 8) & 1)),
1u,
v23,
TokenIsOwner) )
goto LABEL_32;
v58 = (_DWORD *)(v24 + 12);
v14 = 0i64;
if( (*(_DWORD *)(v24 + 8) & 1) == 0 )
v58 = 0i64;
if( v58 && (_DWORD)a10 )
{
if( !AuthzBasepObjectInTypeList(v58, a1, v15, &v63) )
goto LABEL_32;
result = *(unsigned int *)(a1 + 48i64 * v63 + 24);
if( ((unsigned int)result & *(_DWORD *)(v24 + 4)) == 0 )
goto LABEL_32;
}
else
{
result = *(unsigned int *)(v24 + 4);
if( ((unsigned int)result & *(_DWORD *)(a1 + 24)) == 0 )
goto LABEL_33;
}
return result;
case 9:
v46 = *(_WORD *)(v24 + 2);
v47 = 4 * *(unsigned __int8 *)(v24 + 9) + 8;
if( v46 - v47 == 8 )
goto LABEL_34;
if( a5 && !*a6 )
{
AuthzBasepInitializeResourceClaimsFromSacl(a5, (__int64)a6);
v46 = *(_WORD *)(v24 + 2);
v14 = 0i64;
}
v48 = (_QWORD *)v18[137];
if( v48 )
{
v49 = v48[75];
v50 = v48[73];
v51 = v48[74];
v14 = v48[72];
}
else
{
v49 = 0i64;
v50 = 0i64;
v51 = 0i64;
}
AuthzBasepEvaluateAceCondition(
(__int64)v18,
v18[97],
*a6,
v14,
v51,
v50,
v49,
(char *)(v24 + v47 + 8i64),
v46 - v47 - 8,
0,
v23,
&v67);
if( v67 != 1 )
goto LABEL_32;
if( v16 || v23 || !v20 )
goto LABEL_83;
if( SepIsPackageSid((PVOID)(v24 + 8)) )
{
LABEL_63:
v44 = (_DWORD *)(a13 + 4);
SepMatchPackage(
(_TOKEN *)rdx0,
DesiredAccess,
(VOID *)(v24 + 8),
*(unsigned int *)(v24 + 4),
(UINT8 *)(a13 + 21),
(UINT *)(a13 + 4),
(UINT8 *)(a13 + 20));
}
else
{
if( !SepIsCapabilitySid((PVOID)(v24 + 8)) )
{
v18 = (__int64 *)rdx0;
LABEL_83:
if( !*(_DWORD *)(a1 + 24) )
goto LABEL_32;
if( SepSidInToken(v18, PrincipalSelfSid, (PVOID)(v24 + 8), 0, v23, TokenIsOwner) )
{
v40 = *(_DWORD *)(v24 + 4);
break;
}
v25 = PrincipalSelfSid;
LABEL_135:
v14 = 0i64;
goto LABEL_34;
}
LABEL_89:
v44 = (_DWORD *)(a13 + 8);
SepMatchCapability(
rdx0,
DesiredAccess,
(VOID *)(v24 + 8),
*(unsigned int *)(v24 + 4),
(_BYTE *)(a13 + 22),
(_DWORD *)(a13 + 8));
}
v45 = ~*v44;
Data_4 = v45 & v20;
*(_DWORD *)a13 &= v45;
goto LABEL_32;
default:
goto LABEL_34;
}
LABEL_86:
v52 = Data;
LODWORD(GrantedAccess) = 0;
v53 = 0i64;
LODWORD(PackageMatched) = v40;
goto LABEL_87;
}
LABEL_12:
if( !v16 && !v23 && v20 )
{
v42 = SePackagePrefixSid;
if( *(_BYTE *)(v24 + 9) >= 2u
&& *(_BYTE *)(v24 + 8) == *(_BYTE *)SePackagePrefixSid
&& RtlCompareMemory((VOID *)(v24 + 10), (VOID *)(SePackagePrefixSid + 2), 6ui64) == 6
&& *(_DWORD *)(v24 + 16) == *(_DWORD *)(v42 + 8) )
{
goto LABEL_63;
}
v43 = SeCapabilityPrefixSid;
if( *(_BYTE *)(v24 + 9) >= 2u
&& *(_BYTE *)(v24 + 8) == *(_BYTE *)SeCapabilityPrefixSid
&& RtlCompareMemory((VOID *)(v24 + 10), (VOID *)(SeCapabilityPrefixSid + 2), 6ui64) == 6
&& *(_DWORD *)(v24 + 16) == *(_DWORD *)(v43 + 8) )
{
goto LABEL_89;
}
v18 = (__int64 *)rdx0;
}
v27 = *(_DWORD *)(a1 + 24);
v66 = v27;
if( !v27 )
goto LABEL_32;
v28 = 63i64;
if( !v23 )
v28 = 29i64;
v29 = &v18[v28];
v30 = (unsigned __int8 *)(v24 + 8);
if( a14 && v24 != -8 && RtlEqualSid(SeAliasAdminsSid, (PVOID)(v24 + 8)) )
goto LABEL_39;
if( PrincipalSelfSid && RtlEqualSid(SePrincipalSelfSid, (PVOID)(v24 + 8)) )
v30 = (unsigned __int8 *)PrincipalSelfSid;
if( TokenIsOwner
&& *(_WORD *)SeOwnerRightsSid == *(_WORD *)v30
&& !memcmp(SeOwnerRightsSid, v30, 4 * ((unsigned __int64)*(unsigned __int16 *)SeOwnerRightsSid >> 8) + 8) )
{
LABEL_30:
v15 = a2;
v40 = *(_DWORD *)(v24 + 4);
if( (_DWORD)a2 == 1 )
{
*(_DWORD *)(a1 + 24) = v27 & ~v40;
goto LABEL_32;
}
goto LABEL_86;
}
if( !v29 )
{
v15 = a2;
v25 = PrincipalSelfSid;
goto LABEL_135;
}
if( !v30 )
{
v15 = a2;
v25 = PrincipalSelfSid;
v14 = 0i64;
goto LABEL_34;
}
v31 = v30[1];
v32 = 0;
v33 = *(unsigned __int16 *)v30;
v71 = v33;
v75 = 0;
v34 = 4 * v31 + 8;
DesiredAccess_4 = v34;
v35 = v29[(v30[4 * ((unsigned __int64)(unsigned int)v33 >> 8) + 4] & 0xF) + 2] & v29[((unsigned __int64)v30[4 * ((unsigned __int64)(unsigned int)v33 >> 8) + 4] >> 4)
+ 18];
if( !v35 )
{
LABEL_38:
v41 = *(_DWORD *)v29;
if( *(_DWORD *)v29 <= 0x40u )
goto LABEL_39;
v54 = v29[1];
v55 = 64;
v76 = v54;
do
{
v39 = v54 + 16i64 * v55;
if( **(_WORD **)v39 == (_WORD)v33 )
{
if( !memcmp(v30, *(PVOID *)v39, v34) )
goto LABEL_26;
v54 = v76;
LOWORD(v33) = v71;
v34 = DesiredAccess_4;
}
++v55;
}
while( v55 < v41 );
v15 = a2;
v23 = a11;
goto LABEL_32;
}
while( 1 )
{
LOBYTE(v36) = v35;
if( (_BYTE)v35 )
break;
LABEL_54:
v32 += 8;
v35 >>= 8;
v75 = v32;
if( !v35 )
{
v23 = a11;
goto LABEL_38;
}
}
v37 = v29[1];
v38 = v32;
v72 = v37;
v70 = v32;
while( 1 )
{
v69 = *((unsigned __int8 *)SidHashByteToIndexLookupTable + (unsigned __int8)v36);
v39 = v37 + 16i64 * (unsigned int)(v38 + v69);
if( **(_WORD **)v39 == (_WORD)v33 )
break;
LABEL_60:
v38 = v70;
v36 = (unsigned __int8)v36 ^ (1 << v69);
if( !(_BYTE)v36 )
{
v32 = v75;
goto LABEL_54;
}
}
if( memcmp(v30, *(PVOID *)v39, v34) )
{
v37 = v72;
LOWORD(v33) = v71;
v34 = DesiredAccess_4;
goto LABEL_60;
}
LABEL_26:
v23 = a11;
if( !a11 && v39 == v29[1] && (*(_DWORD *)(v39 + 8) & 0x10) == 0 || (*(_DWORD *)(v39 + 8) & 4) != 0 )
{
v27 = v66;
goto LABEL_30;
}
LABEL_39:
v15 = a2;
LABEL_32:
v14 = 0i64;
LABEL_33:
v25 = PrincipalSelfSid;
LABEL_34:
result = *(unsigned __int16 *)(v24 + 2);
v20 = Data_4;
v24 += result;
v18 = (__int64 *)rdx0;
++Data;
}
while( Data < v68 );
return result;
}Referenced by:
SepAccessCheck