SepGetDefaultsSubjectContext

VOID __fastcall SepGetDefaultsSubjectContext(
        _SECURITY_SUBJECT_CONTEXT *SubjectContext,
        VOID **Owner,
        VOID **Group,
        VOID **ServerOwner,
        VOID **ServerGroup,
        VOID **IntegrityLabel,
        VOID **TrustLabel,
        _ACL **Dacl){
  unsigned int *ClientToken; 
  unsigned int *PrimaryToken; 
  VOID *v11; 
  _ACL *v12; 
  VOID **TokenIntegrity; 
  SECURITY_SUBJECT_CONTEXT *v14; 
  VOID *v15; 
  ClientToken = (unsigned int *)SubjectContext->ClientToken;
  PrimaryToken = (unsigned int *)SubjectContext->PrimaryToken;
  if( !ClientToken )
    ClientToken = (unsigned int *)SubjectContext->PrimaryToken;
  v11 = (VOID *)*((_QWORD *)ClientToken + 21);
  *Owner = *(VOID **)(*((_QWORD *)ClientToken + 19) + 16i64 * ClientToken[36]);
  v12 = (_ACL *)*((_QWORD *)ClientToken + 23);
  *Group = v11;
  *Dacl = v12;
  *ServerOwner = *(VOID **)(*((_QWORD *)PrimaryToken + 19) + 16i64 * PrimaryToken[36]);
  *ServerGroup = (VOID *)*((_QWORD *)PrimaryToken + 21);
  TokenIntegrity = (VOID **)SepLocateTokenIntegrity((INT64)ClientToken);
  if( TokenIntegrity )
    *IntegrityLabel = *TokenIntegrity;
  else
    *IntegrityLabel = SepDefaultMandatorySid;
  LODWORD(v15) = SepLocateTokenTrustLevel(v14);
  *TrustLabel = v15;
}

Referenced by: