SepAccessCheckEx
char __fastcall SepAccessCheckEx(
__int64 a1,
__int64 a2,
__int64 a3,
__int64 a4,
int a5,
__int128 *a6,
int a7,
_DWORD *a8,
int a9,
char a10,
int *a11,
LUID **a12,
int *a13,
__int64 a14,
int a15,
char a16,
char a17,
__int64 a18,
__int64 *a19,
bool *a20){
unsigned int v20;
LUID **v21;
__int64 v24;
_DWORD *v27;
char v28;
unsigned int v29;
int v30;
unsigned int v31;
__int64 *v32;
__int64 v33;
__int16 v34;
__int16 v35;
__int64 v36;
INT64 v37;
int v38;
int v39;
UINT64 v40;
UINT8 v41;
int v42;
UINT64 v44;
int v45;
int v46;
int v47;
int v48;
int v49;
int v50;
__int64 v51;
INT64 v52;
CHAR v53;
__int128 *v54;
UINT64 v55;
UINT64 v56;
UINT64 v57;
UINT64 v58;
int v59;
int v60;
int v61;
int v62;
int v63;
int v64;
UINT64 v65;
UINT64 v66;
PRIVILEGE_SET **Privileges;
PRIVILEGE_SET **Privilegesc;
PRIVILEGE_SET **Privilegesa;
PRIVILEGE_SET **Privilegesb;
INT64 v71;
INT64 v72;
INT64 v73;
UINT64 v74;
UINT64 v75;
INT64 v76;
INT64 v77;
INT64 v78;
INT64 v79;
INT64 v80;
INT64 v81;
INT64 v82;
INT64 v83;
UINT8 SystemSecurity;
UINT8 Relabel;
UINT8 WriteOwner;
unsigned int PrivilegeCount;
UINT64 PrivilegeCount_4;
INT64 v90;
VOID *v91;
INT64 v92;
int v93;
INT64 v94;
int v95;
INT64 v96[2];
__int128 v97;
__int128 v98;
v20 = 0;
v21 = a12;
v24 = a1;
v27 = a8;
v28 = 1;
if( !a4 )
a4 = a3;
v91 = (VOID *)a3;
v29 = a5;
v30 = a5;
PrivilegeCount = 0;
SystemSecurity = 0;
WriteOwner = 0;
Relabel = 0;
PrivilegeCount_4 = a4;
*(_OWORD *)v96 = 0i64;
v97 = 0i64;
v98 = 0i64;
if( a7 )
{
v31 = a7;
}
else
{
DWORD1(v97) = -1;
a6 = (__int128 *)v96;
v31 = 1;
}
v32 = (__int64 *)a6 + 5;
v33 = v31;
do
{
*v32 = a14;
a14 += 128i64;
v32 += 6;
--v33;
}
while( v33 );
if( (a5 & 0x1000000) == 0 )
{
v20 = a9;
goto LABEL_9;
}
v92 = *(_QWORD *)SeSecurityPrivilege;
v93 = 0;
v53 = SepPrivilegeCheck(a4, (INT64)&v92, 1ui64, 1, a10);
v54 = a6;
v55 = 0x1000000i64;
v56 = 8i64;
if( !v53 )
{
v42 = -1073741727;
LOBYTE(v71) = 0;
v57 = 0x100000i64;
goto LABEL_56;
}
LOBYTE(v71) = 0;
LODWORD(Privileges) = v31;
v20 = a9 | 0x1000000;
AuthzBasepSetTypeListAccessReasons(0x1000000ui64, 0x200000ui64, 8ui64, (INT64)a6, (UINT64)Privileges, v71);
v40 = 1i64;
v41 = 1;
PrivilegeCount = 1;
SystemSecurity = 1;
v30 = a5 & 0xFEFFFFFF;
if( (a5 & 0xFEFFFFFF) != 0 )
{
a4 = PrivilegeCount_4;
v24 = a1;
v29 = a5;
v27 = a8;
LABEL_9:
v34 = *(_WORD *)(v24 + 2);
v35 = v34 & 4;
if( (v34 & 4) != 0 )
{
if( v34 >= 0 )
{
v37 = *(_QWORD *)(v24 + 32);
goto LABEL_13;
}
v36 = *(unsigned int *)(v24 + 16);
v37 = 0i64;
if( (_DWORD)v36 )
{
v37 = v24 + v36;
LABEL_13:
v90 = v37;
goto LABEL_14;
}
}
else
{
v37 = 0i64;
}
v90 = 0i64;
LABEL_14:
if( (v34 & 0x10) == 0 )
{
LABEL_15:
v92 = 0i64;
LABEL_16:
if( !v35 || !v37 )
{
LOBYTE(v71) = 0;
v64 = v20 | v29;
LODWORD(Privileges) = v31;
v20 |= v29;
if( (v29 & 0x2000000) != 0 )
{
v20 = v64 & 0xFDFFFFFF | v27[3];
AuthzBasepSetTypeListAccessReasons(v20, 0x500000ui64, 0i64, (INT64)a6, (UINT64)Privileges, v71);
if( (*(_DWORD *)(PrivilegeCount_4 + 200) & 0x4000) == 0 )
goto LABEL_25;
LOBYTE(v73) = 1;
}
else
{
AuthzBasepSetTypeListAccessReasons(v29, 0x500000ui64, 0i64, (INT64)a6, (UINT64)Privileges, v71);
if( (*(_DWORD *)(PrivilegeCount_4 + 200) & 0x4000) == 0 )
goto LABEL_25;
LOBYTE(v73) = 0;
}
LODWORD(Privilegesb) = v31;
v20 = 0;
AuthzBasepSetTypeListAccessReasons(0i64, v65, v66, (INT64)a6, (UINT64)Privilegesb, v73);
*(_BYTE *)(a18 + 21) = 0;
*(_DWORD *)(a18 + 4) = 0;
goto LABEL_100;
}
if( (v30 & 0x80000) == 0 )
goto LABEL_19;
v94 = SeTakeOwnershipPrivilege;
v95 = 0;
if( SepPrivilegeCheck(a4, (INT64)&v94, 1ui64, 1, a10) )
{
LOBYTE(v71) = 0;
LODWORD(Privilegesa) = v31;
v20 |= 0x80000u;
AuthzBasepSetTypeListAccessReasons(0x80000ui64, 0x200000ui64, 9ui64, (INT64)a6, (UINT64)Privilegesa, v71);
WriteOwner = 1;
}
else
{
v94 = SeRelabelPrivilege;
v95 = 0;
if( !SepPrivilegeCheck(PrivilegeCount_4, (INT64)&v94, v58, 1, a10) )
{
LABEL_19:
if( *(_WORD *)(v37 + 4) )
{
LOBYTE(v82) = 0;
if( (a5 & 0x2000000) != 0 )
{
LODWORD(v80) = 0;
LODWORD(v78) = a7;
LODWORD(v74) = v31;
SepMaximumAccessCheckEx(
(INT64 *)PrivilegeCount_4,
v91,
v90,
v92,
a19,
0i64,
v74,
(INT64)a6,
v78,
v80,
v82,
a16,
a17,
a18);
LOBYTE(v72) = 0;
LODWORD(Privilegesc) = v31;
AuthzBasepSetTypeListAccessReasons(
0xFFFFFFFFui64,
0x800000ui64,
0i64,
(INT64)a6,
(UINT64)Privilegesc,
v72);
v38 = *(_DWORD *)(PrivilegeCount_4 + 200);
if( (v38 & 0x10) != 0 )
{
if( (v38 & 8) != 0 )
v63 = a8[1] & ~(*a8 | a8[2]) | 0x10D0000;
else
v63 = a8[3] | 0x1FFFFF;
LOBYTE(v83) = 1;
LODWORD(v81) = v63;
LODWORD(v79) = a7;
LODWORD(v75) = v31;
SepMaximumAccessCheckEx(
(INT64 *)PrivilegeCount_4,
v91,
v90,
v92,
a19,
0i64,
v75,
(INT64)a6,
v79,
v81,
v83,
a16,
a17,
a18);
v38 = *(_DWORD *)(PrivilegeCount_4 + 200);
}
v39 = *((_DWORD *)a6 + 7);
if( (v38 & 0x2000) != 0 )
goto LABEL_23;
if( (v38 & 0x4000) != 0 )
{
v39 &= *(_DWORD *)(a18 + 4) | *(_DWORD *)(a18 + 8);
}
else
{
if( !*(_BYTE *)(a18 + 20) )
{
LABEL_23:
if( (~(v39 | 0x2000000) & v30) != 0 )
{
v42 = -1073741790;
v20 = 0;
goto LABEL_30;
}
v20 |= v39;
goto LABEL_25;
}
v39 &= *(_DWORD *)(a18 + 4);
}
v20 &= ~*(_DWORD *)a18;
goto LABEL_23;
}
LODWORD(v76) = v31;
SepNormalAccessCheckEx(
v30,
PrivilegeCount_4,
(__int64)v91,
v90,
v92,
a19,
0,
v76,
(__int64)a6,
a7,
0,
a16,
a17,
(_DWORD *)a18);
*(_DWORD *)(a18 + 12) = *((_DWORD *)a6 + 6);
if( *((_DWORD *)a6 + 6) )
goto LABEL_44;
v44 = PrivilegeCount_4;
v45 = *(_DWORD *)(PrivilegeCount_4 + 200);
if( (v45 & 0x10) != 0 )
{
if( (v45 & 8) != 0 )
v60 = a8[1] & ~(*a8 | a8[2]) | 0x10D0000;
else
v60 = a8[3] | 0x1FFFFF;
v47 = a5;
v46 = 0;
if( (v60 & a5) == 0 )
{
LABEL_37:
*(_DWORD *)(a18 + 12) = v46;
if( !*((_DWORD *)a6 + 6) )
{
v48 = *(_DWORD *)(v44 + 200);
if( (v48 & 0x2000) != 0 )
{
LABEL_42:
v20 |= v47;
LABEL_25:
v40 = PrivilegeCount;
LABEL_26:
v41 = SystemSecurity;
v21 = a12;
goto LABEL_27;
}
v49 = v47 | v30;
if( (v48 & 0x4000) != 0 )
{
v61 = ~(*(_DWORD *)(a18 + 4) | *(_DWORD *)(a18 + 8));
v62 = v49 | *(_DWORD *)a18;
}
else
{
v50 = 0;
if( !*(_BYTE *)(a18 + 20) )
goto LABEL_41;
v61 = v49 | *(_DWORD *)a18;
v62 = ~*(_DWORD *)(a18 + 4);
}
v50 = v62 & v61;
LABEL_41:
*((_DWORD *)a6 + 6) = v50;
if( v50 )
{
v42 = -1073741790;
v20 = 0;
goto LABEL_30;
}
goto LABEL_42;
}
LABEL_44:
v42 = -1073741790;
LABEL_45:
v20 = 0;
goto LABEL_30;
}
LODWORD(v77) = v31;
SepNormalAccessCheckEx(
v30 & v60,
PrivilegeCount_4,
(__int64)v91,
v90,
v92,
a19,
0,
v77,
(__int64)a6,
a7,
1,
a16,
a17,
(_DWORD *)a18);
v46 = *((_DWORD *)a6 + 6);
v44 = PrivilegeCount_4;
}
else
{
v46 = 0;
}
v47 = a5;
goto LABEL_37;
}
*(_DWORD *)(a18 + 12) = v30;
v59 = *(_DWORD *)(PrivilegeCount_4 + 200);
if( (v59 & 0x4000) != 0 )
v20 &= ~*(_DWORD *)a18;
if( v30 == 0x2000000 )
{
if( v20 )
goto LABEL_25;
}
else if( !v30 && *(_DWORD *)a18 && v20 && (v59 & 0x6000) == 0 )
{
goto LABEL_25;
}
v20 = 0;
LOBYTE(v71) = 0;
v42 = -1073741790;
v54 = a6;
v56 = 0i64;
v57 = 6291456i64;
v55 = 4261412863i64;
LABEL_56:
LODWORD(Privileges) = v31;
AuthzBasepSetTypeListAccessReasons(v55, v57, v56, (INT64)v54, (UINT64)Privileges, v71);
goto LABEL_30;
}
LOBYTE(v71) = 0;
v20 |= 0x80000u;
LODWORD(Privileges) = v31;
AuthzBasepSetTypeListAccessReasons(0x80000ui64, 0x200000ui64, 0x20ui64, (INT64)a6, (UINT64)Privileges, v71);
Relabel = 1;
}
v40 = ++PrivilegeCount;
v30 &= ~0x80000u;
if( !v30 )
goto LABEL_26;
goto LABEL_19;
}
if( v34 >= 0 )
{
v52 = *(_QWORD *)(v24 + 24);
}
else
{
v51 = *(unsigned int *)(v24 + 12);
if( !(_DWORD)v51 )
goto LABEL_15;
v52 = v24 + v51;
}
v92 = v52;
goto LABEL_16;
}
LABEL_27:
if( !v20 )
{
LABEL_100:
v42 = -1073741790;
goto LABEL_30;
}
v42 = 0;
if( KeGetCurrentIrql() < 2u )
{
if( (_DWORD)v40 )
{
SepAssemblePrivileges(v40, v41, WriteOwner, Relabel, (PRIVILEGE_SET **)v21);
if( v21 )
{
if( !*v21 )
{
v28 = 0;
v42 = -1073741801;
goto LABEL_45;
}
}
}
}
LABEL_30:
*a13 = v42;
*a11 = v20;
if( a20 )
*a20 = v42 >= 0;
return v28;
}Referenced by:
SepCommonAccessCheckExWithAdminlessChecks