SepMaximumAccessCheckEx
INT64 __fastcall SepMaximumAccessCheckEx(
INT64 *Token,
VOID *rdx0,
INT64 a3,
INT64 a4,
INT64 *a5,
INT64 a6,
UINT64 a2,
INT64 a1,
INT64 a9,
INT64 a10,
INT64 a11,
UINT8 a12,
CHAR a13,
INT64 a14){
int v15;
int v17;
char v18;
__int64 v19;
__int64 v20;
INT64 result;
unsigned int v22;
INT64 v23;
INT64 v24;
char v25;
UINT8 v26;
UINT64 v27;
unsigned int *v28;
__int64 v29;
unsigned int v30;
int v31;
VOID *v32;
_DWORD *v33;
int v34;
__int64 v35;
_DWORD *v36;
void *v37;
UINT8 v38;
ACCESS_REASONS *v39;
UINT64 v40;
unsigned int v41;
_QWORD *v42;
__int64 v43;
__int64 v44;
__int64 v45;
__int64 v46;
unsigned int v47;
_QWORD *v48;
__int64 v49;
__int64 v50;
__int64 v51;
__int64 v52;
_DWORD *v53;
int v54;
__int64 v55;
INT64 Restricted;
INT64 TokenIsOwner;
unsigned int v58;
unsigned int v59;
PVOID v60;
int v61;
INT64 v62;
v62 = a4;
v60 = rdx0;
v59 = 0;
v15 = *((_DWORD *)Token + 50);
v61 = 0;
v17 = v15 & 0x2000;
v18 = a11;
v19 = a1;
v20 = (unsigned int)a2;
LODWORD(a6) = v17;
if( (_BYTE)a11 && (_DWORD)a2 )
{
v28 = (unsigned int *)(a1 + 28);
v29 = (unsigned int)a2;
do
{
AuthzBasepSetAccessReasons(*v28, 0x800000ui64, 0i64, *(ACCESS_REASONS **)(v28 + 3), 1u);
v30 = *v28;
*v28 &= v31;
*(v28 - 1) = v30;
v28 += 12;
--v29;
}
while( v29 );
v18 = a11;
v17 = a6;
a4 = v62;
}
result = *(unsigned __int16 *)(a3 + 4);
v22 = 0;
v23 = a3 + 8;
v58 = result;
if( (_DWORD)result )
{
v24 = a14;
do
{
if( (*(_BYTE *)(v23 + 1) & 8) != 0 )
goto LABEL_12;
v25 = *(_BYTE *)v23;
if( *(_BYTE *)v23 )
{
if( v25 == 5 )
{
v34 = *(_DWORD *)(v23 + 8);
v35 = v34 & 1;
v36 = (_DWORD *)((v23 + 12) & -(__int64)((v34 & 1) != 0));
if( v36 )
{
if( !(_DWORD)a9
|| !SepSidInToken(Token, 0i64, (PVOID)(v23 + ((8i64 * (v34 & 2)) | 0xC) + 16 * v35), 0, v18, a12)
|| !AuthzBasepObjectInTypeList(v36, v19, v20, &v59) )
{
goto LABEL_12;
}
LODWORD(TokenIsOwner) = 1;
goto LABEL_35;
}
v37 = (void *)(v23 + ((8i64 * (v34 & 2)) | 0xC) + 16 * v35);
LABEL_30:
v26 = SepSidInToken(Token, 0i64, v37, 0, v18, a12);
goto LABEL_8;
}
if( v25 != 4 )
{
if( v25 == 1 )
goto LABEL_90;
if( v25 == 6 )
{
if( !SepSidInToken(
Token,
0i64,
(PVOID)(v23 + ((8i64 * (*(_DWORD *)(v23 + 8) & 2)) | 0xC) + 16i64 * (*(_DWORD *)(v23 + 8) & 1)),
1u,
v18,
a12) )
goto LABEL_12;
if( ((v23 + 12) & -(__int64)((*(_DWORD *)(v23 + 8) & 1) != 0)) != 0 )
{
if( !(_DWORD)a9 )
{
v39 = *(ACCESS_REASONS **)(v19 + 40);
v40 = *(_DWORD *)(v23 + 4) & (unsigned int)~*(_DWORD *)(v19 + 28);
*(_DWORD *)(v19 + 32) |= v40;
AuthzBasepSetAccessReasons(v40, 0x20000ui64, v22, v39, 0);
goto LABEL_12;
}
if( !AuthzBasepObjectInTypeList(
(_DWORD *)((v23 + 12) & -(__int64)((*(_DWORD *)(v23 + 8) & 1) != 0)),
v19,
v20,
&v59) )
goto LABEL_12;
LODWORD(TokenIsOwner) = 2;
LABEL_35:
v27 = v59;
LABEL_11:
LODWORD(Restricted) = *(_DWORD *)(v23 + 4);
AuthzBasepAddAccessTypeList(v19, (unsigned int)v20, v27, v22, Restricted, TokenIsOwner);
goto LABEL_12;
}
LABEL_91:
LODWORD(TokenIsOwner) = 2;
LABEL_10:
v27 = 0i64;
goto LABEL_11;
}
if( v25 != 9 )
{
if( !a13 )
goto LABEL_12;
if( v25 != 10 )
goto LABEL_12;
if( KeGetCurrentIrql() >= 2u )
goto LABEL_12;
v47 = 4 * *(unsigned __int8 *)(v23 + 9) + 8;
if( *(unsigned __int16 *)(v23 + 2) - v47 == 8 )
goto LABEL_12;
if( a4 && !*a5 )
AuthzBasepInitializeResourceClaimsFromSacl(a4, (__int64)a5);
v48 = (_QWORD *)Token[137];
v49 = v48 ? v48[75] : 0i64;
v50 = v48 ? v48[73] : 0i64;
v51 = v48 ? v48[74] : 0i64;
v52 = v48 ? v48[72] : 0i64;
AuthzBasepEvaluateAceCondition(
(__int64)Token,
Token[97],
*a5,
v52,
v51,
v50,
v49,
(char *)(v23 + v47 + 8i64),
*(unsigned __int16 *)(v23 + 2) - v47 - 8,
1,
v18,
&v61);
if( ((v61 + 1) & 0xFFFFFFFD) != 0 )
goto LABEL_12;
LABEL_90:
if( !SepSidInToken(Token, 0i64, (PVOID)(v23 + 8), 1u, v18, a12) )
goto LABEL_12;
goto LABEL_91;
}
v41 = 4 * *(unsigned __int8 *)(v23 + 9) + 8;
if( *(unsigned __int16 *)(v23 + 2) - v41 == 8 )
goto LABEL_12;
if( a4 && !*a5 )
AuthzBasepInitializeResourceClaimsFromSacl(a4, (__int64)a5);
v42 = (_QWORD *)Token[137];
v43 = v42 ? v42[75] : 0i64;
v44 = v42 ? v42[73] : 0i64;
v45 = v42 ? v42[74] : 0i64;
v46 = v42 ? v42[72] : 0i64;
AuthzBasepEvaluateAceCondition(
(__int64)Token,
Token[97],
*a5,
v46,
v45,
v44,
v43,
(char *)(v23 + v41 + 8i64),
*(unsigned __int16 *)(v23 + 2) - v41 - 8,
0,
v18,
&v61);
if( v61 != 1 )
goto LABEL_12;
if( !(_DWORD)a6 && !v18 )
{
v32 = (VOID *)(v23 + 8);
if( SepIsPackageSid((PVOID)(v23 + 8)) )
{
LABEL_23:
v33 = (_DWORD *)(v24 + 4);
SepMatchPackage(
(_TOKEN *)Token,
0xFFFFFFFFui64,
v32,
*(unsigned int *)(v23 + 4),
(UINT8 *)(v24 + 21),
(UINT *)(v24 + 4),
(UINT8 *)(v24 + 20));
LABEL_25:
v18 = a11;
*(_DWORD *)v24 &= ~*v33;
goto LABEL_12;
}
if( SepIsCapabilitySid((PVOID)(v23 + 8)) )
goto LABEL_24;
v18 = a11;
}
v37 = (void *)(v23 + 8);
goto LABEL_30;
}
v38 = a12;
if( !SepSidInToken(Token, 0i64, (PVOID)(v23 + 4 * (*(unsigned __int8 *)(v23 + 13) + 5i64)), 0, v18, a12) )
goto LABEL_12;
v26 = SepSidInToken(v60, 0i64, (PVOID)(v23 + 12), 0, 0, v38);
}
else
{
if( !v17 && !v18 )
{
v32 = (VOID *)(v23 + 8);
if( SepIsPackageSid((PVOID)(v23 + 8)) )
goto LABEL_23;
if( SepIsCapabilitySid((PVOID)(v23 + 8)) )
{
LABEL_24:
v33 = (_DWORD *)(v24 + 8);
SepMatchCapability(
(INT64)Token,
0xFFFFFFFFi64,
v32,
*(unsigned int *)(v23 + 4),
(_BYTE *)(v24 + 22),
(_DWORD *)(v24 + 8));
goto LABEL_25;
}
v18 = a11;
}
v26 = SepSidInToken(Token, 0i64, (PVOID)(v23 + 8), 0, v18, a12);
}
LABEL_8:
if( v26 )
{
LODWORD(TokenIsOwner) = 1;
goto LABEL_10;
}
LABEL_12:
result = *(unsigned __int16 *)(v23 + 2);
++v22;
v17 = a6;
v23 += result;
a4 = v62;
}
while( v22 < v58 );
}
if( v18 && (_DWORD)v20 )
{
v53 = (_DWORD *)(v19 + 28);
v54 = ~(_DWORD)a10;
v55 = v20;
do
{
result = *(v53 - 1) & ((unsigned int)v54 | *v53);
*v53 = result;
v53 += 12;
--v55;
}
while( v55 );
}
return result;
}Referenced by:
SepAccessCheckEx