PspCombineSecurityDomains

NTSTATUS __stdcall PspCombineSecurityDomains(PVOID Object, PVOID a2){
  __int64 v4; 
  __int64 v5; 
  NTSTATUS AccessState; 
  NTSTATUS v7; 
  signed __int64 v9; 
  int v10[8]; 
  POBJECT_TYPE ObjectType; 
  HANDLE v12; 
  HANDLE Handle; 
  INT64 result[4]; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int64 v16[28]; 
  memset((INT64)result, 0i64);
  memset((INT64)v16, 0i64);
  if( (*((_DWORD *)Object + 543) & 0x400000) == 0 || (*((_DWORD *)a2 + 543) & 0x400000) == 0 )
    return -1073741700;
  _InterlockedOr(v10, 0);
  v4 = *((_QWORD *)Object + 316);
  v5 = *((_QWORD *)a2 + 316);
  if( v4 == v5 )
    return 0;
  if( !v4 || !v5 || *((int *)Object + 628) < 0 || *((int *)a2 + 628) < 0 )
    return -1073740699;
  Handle = 0i64;
  v12 = 0i64;
  LODWORD(ObjectType) = 40;
  AccessState = SeCreateAccessStateEx(
                  0i64,
                  (_EPROCESS *)a2,
                  (_ACCESS_STATE *)result,
                  (_AUX_ACCESS_DATA *)v16,
                  (UINT64)ObjectType,
                  (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
  if( AccessState >= 0 )
  {
    v7 = ObOpenObjectByPointer(Object, 0x600u, (PACCESS_STATE)result, 0, (POBJECT_TYPE)PsProcessType, 0, &Handle);
    AccessState = v7;
    if( v7 >= 0 )
    {
      SepDeleteAccessState((ACCESS_STATE *)result);
      SeReleaseSubjectContext(&SubjectContext);
      LODWORD(ObjectType) = 40;
      AccessState = SeCreateAccessStateEx(
                      0i64,
                      (_EPROCESS *)Object,
                      (_ACCESS_STATE *)result,
                      (_AUX_ACCESS_DATA *)v16,
                      (UINT64)ObjectType,
                      (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
      if( AccessState < 0 )
        goto LABEL_14;
      v7 = ObOpenObjectByPointer(a2, 0x600u, (PACCESS_STATE)result, 0, (POBJECT_TYPE)PsProcessType, 0, &v12);
      AccessState = v7;
      if( v7 >= 0 )
      {
        _InterlockedOr((volatile signed __int32 *)Object + 543, 0x200000u);
        *((_QWORD *)Object + 316) = *((_QWORD *)a2 + 316);
        if( (*((_DWORD *)Object + 628) | *((_DWORD *)a2 + 628)) < 0 )
        {
          v9 = _InterlockedIncrement64(&PsNextSecurityDomain);
          AccessState = -1073740699;
          *((_QWORD *)Object + 316) = v9;
          *((_QWORD *)Object + 317) = v9;
        }
        KeSynchronizeSecurityDomain((__int64)Object);
        goto LABEL_13;
      }
      v12 = 0i64;
    }
    else
    {
      Handle = 0i64;
    }
    if( v7 == -1073741790 )
      AccessState = -1073740699;
LABEL_13:
    SepDeleteAccessState((ACCESS_STATE *)result);
    SeReleaseSubjectContext(&SubjectContext);
  }
LABEL_14:
  if( v12 )
    ObCloseHandle(v12, 0);
  if( Handle )
    ObCloseHandle(Handle, 0);
  return AccessState;
}

Referenced by: