SepModifyTokenPolicyCounter
VOID __stdcall SepModifyTokenPolicyCounter(_SEP_AUDIT_POLICY *TokenPolicy, UINT8 bIncrement){
volatile signed __int32 *v2;
bool v3;
int v4;
__int64 *v5;
int v6;
__int64 v7;
unsigned __int16 v8;
char v9;
unsigned __int16 v10;
v2 = SepTokenPolicyCounterByCategory;
v3 = bIncrement != 0;
v4 = 0;
v5 = AdtpPerCategoryCount;
v6 = v3 ? 2 : 0;
v7 = 9i64;
do
{
v8 = *(_WORD *)v5;
v9 = 0;
v10 = 0;
if( *(_WORD *)v5 )
{
do
{
if( ((TokenPolicy->AdtTokenPolicy.PerUserPolicy[(unsigned __int64)(v4 + (unsigned int)v10) >> 1] >> (4 * ((v4 + v10) & 1))) & 0xF) != 0 )
{
_InterlockedExchangeAdd((volatile signed __int32 *)SepTokenPolicyCounter + v4 + (unsigned int)v10, v6 - 1);
v9 = 1;
}
v8 = *(_WORD *)v5;
++v10;
}
while( v10 < *(_WORD *)v5 );
if( v9 )
{
_InterlockedExchangeAdd(v2, v6 - 1);
v8 = *(_WORD *)v5;
}
}
++v2;
v4 += v8;
v5 = (__int64 *)((char *)v5 + 2);
--v7;
}
while( v7 );
}Referenced by:
NtSetInformationToken
SepDuplicateToken
SepFilterToken
SepTokenDeleteMethod