SeAdjustAccessStateForAccessConstraints

VOID __stdcall SeAdjustAccessStateForAccessConstraints(
        PVOID ObjectType,
        PSECURITY_DESCRIPTOR SecurityDescriptor,
        PACCESS_STATE AccessState){
  int v3; 
  int v4; 
  int Mask; 
  int v8; 
  int v9; 
  __int64 v10; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *TrustLabelAce; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *v12; 
  int v13; 
  int v14; 
  int v15; 
  ULONG *p_SidStart; 
  PVOID v17; 
  int v18; 
  int v19; 
  UINT8 pbDominate; 
  __int64 v21; 
  v3 = 0;
  pbDominate = 0;
  v21 = 0i64;
  v4 = -1;
  Mask = -1;
  if( (*((_DWORD *)AccessState + 3) & 6) != 0 )
  {
    v8 = *((_DWORD *)ObjectType + 17);
    if( v8 == 1 )
    {
      v3 = 17957001;
      v9 = 18809110;
    }
    else if( v8 == 256 )
    {
      v3 = 16908313;
      v9 = 17760262;
    }
    else
    {
      v9 = 0;
    }
    v10 = *((_QWORD *)AccessState + 4);
    if( !v10 )
      v10 = *((_QWORD *)AccessState + 6);
    SepFilterCheck((__int64)SecurityDescriptor, 0i64, v10, 1, (char *)&v21);
    if( BYTE4(v21) )
      v4 = v21;
    TrustLabelAce = SeGetTrustLabelAce(SecurityDescriptor);
    v12 = TrustLabelAce;
    if( TrustLabelAce )
    {
      p_SidStart = &TrustLabelAce->SidStart;
      if( TrustLabelAce == (_SYSTEM_PROCESS_TRUST_LABEL_ACE *)-8i64
        || (LODWORD(v17) = SepLocateTokenTrustLevel((SECURITY_SUBJECT_CONTEXT *)AccessState + 1),
            RtlSidDominatesForTrust(v17, p_SidStart, &pbDominate),
            !pbDominate) )
      {
        Mask = v12->Mask;
      }
    }
    v13 = ~(v4 & Mask);
    v14 = v13 & v3;
    v15 = v13 & v9;
    if( Mask != -1 || v4 != -1 )
    {
      v18 = *((_DWORD *)AccessState + 3);
      v19 = *((_DWORD *)AccessState + 5);
      if( (v18 & 2) != 0 )
        v19 &= ~v14;
      if( (v18 & 4) != 0 )
        v19 &= ~v15;
      *((_DWORD *)AccessState + 5) = v19;
    }
  }
}

Referenced by: