SepCommonAccessCheckExWithAdminlessChecks
VOID __fastcall SepCommonAccessCheckExWithAdminlessChecks(
SECURITY_SUBJECT_CONTEXT *SubjectContext,
CHAR a2,
INT64 a3,
INT64 a4,
INT64 a5,
CHAR a6,
CHAR a7,
CHAR a8){
SECURITY_SUBJECT_CONTEXT *v10;
_DWORD *v12;
_DWORD *v13;
_DWORD *v14;
_QWORD *v15;
ACCESS_REASONS *v16;
unsigned int v17;
INT64 v18;
char v19;
__int64 v20;
int v21;
int v22;
ACL *v23;
int *v24;
int v25;
int *v26;
__int64 ClientToken;
__int64 v28;
int v29;
int *v30;
int v31;
__int64 v32;
int v33;
char v34;
_DWORD *v35;
char v36;
int v37;
char v38;
UINT8 IsOwner;
int v40;
int v41;
char v42;
char v43;
__int64 v44;
__int64 v45;
__int64 PrimaryToken;
char v47;
RTL_DYNAMIC_HASH_TABLE_ENTRY *v48;
INT64 v49;
CHAR *v50;
int v51;
int *v52;
_DWORD *v53;
int v54;
char v55;
int *v56;
_DWORD *v57;
int v58;
int v59;
char v60;
_DWORD *v61;
int v62;
char v63;
__int64 v64;
__int16 v65;
__int64 v66;
ACL *v67;
UINT8 v68;
UINT64 v69;
int v70;
int v71;
int v72;
unsigned int v73;
int v74;
int *v75;
int v76;
_QWORD *v77;
bool v78;
__int64 v79;
UINT64 v80;
unsigned int v81;
UINT64 v82;
UINT64 v83;
__int64 v84;
int v85;
__int64 v86;
__int16 v87;
__int64 v88;
ACL *v89;
void *v90;
NTSTATUS Cap;
RTL_DYNAMIC_HASH_TABLE_ENTRY *v92;
bool v93;
int *v94;
char *v95;
int v96;
int v97;
unsigned int **v98;
unsigned int *v99;
unsigned int v100;
_DWORD *v101;
__int64 v102;
char v103;
char *PoolWithTag;
volatile INT64 *Blink;
unsigned int Blink_high;
unsigned int v107;
PVOID v108;
int v109;
int v110;
_QWORD *v111;
__int64 v112;
__int64 v113;
__int64 v114;
__int64 v115;
int v116;
int v117;
int v118;
_QWORD *v119;
__int64 v120;
__int64 v121;
__int64 v122;
__int64 v123;
int v124;
int v125;
__int64 v126;
__int64 v127;
char v128;
int v129;
int v130;
int v131;
int v132;
int v133;
void *v134;
int v135;
int v136;
__int64 v137;
__int64 v138;
__int64 v139;
int v140;
int v141;
__int64 v142;
int v143;
int v144;
unsigned int v145;
char *v146;
int v147;
UINT64 v148;
int v149;
unsigned int v150;
unsigned int v151;
bool v152;
_LIST_ENTRY *v153;
_LIST_ENTRY *v154;
_LIST_ENTRY *v155;
_DWORD *v156;
ACCESS_REASONS *v157;
int v158;
int v159;
__int64 v160;
UINT64 v161;
_LIST_ENTRY *v162;
UINT8 OverWrite;
UINT64 v164;
_DWORD *v165;
_DWORD *v166;
_DWORD *v167;
int v168;
int *v169;
LUID **v170;
int *v171;
__int64 v172;
int v173;
int v174;
char v175;
char v176;
BOOL v178;
char v179;
char v180;
char v181;
bool v182;
unsigned int v183;
UINT64 Data;
PVOID P;
unsigned int v186;
int v187;
int v188;
int v189;
int v190;
RTL_DYNAMIC_HASH_TABLE_ENTRY *v191;
int v192;
int v193;
INT64 v194;
__int64 v195;
unsigned int v196;
int v197;
ACL *Sacl;
VOID *InputToken;
int v200;
int v201;
int v202;
INT64 v203[2];
__int64 v204;
SECURITY_SUBJECT_CONTEXT *v205;
__int128 SecurityDescriptor[2];
__int64 v207;
__int128 CapeSecurityDescriptor[2];
__int64 v209;
_DWORD v210[5];
ACL *v211;
__int128 v212;
__int128 v213;
__int128 v214;
INT64 result[16];
ACCESS_REASONS v216;
INT64 v217[16];
v205 = SubjectContext;
LOBYTE(v178) = 0;
v182 = 0;
v211 = 0i64;
Sacl = 0i64;
v10 = SubjectContext;
v207 = 0i64;
v209 = 0i64;
v197 = 0;
v201 = 0;
v191 = 0i64;
v176 = 0;
*(_OWORD *)v203 = 0i64;
P = 0i64;
*(_OWORD *)&v210[1] = 0i64;
v192 = 0;
memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
memset(CapeSecurityDescriptor, 0, sizeof(CapeSecurityDescriptor));
memset((INT64)result, 0i64);
memset((INT64)&v216, 0i64);
memset((INT64)v217, 0i64);
HIBYTE(v178) = 0;
LODWORD(v194) = -1;
v202 = -1;
if( !a4 )
return;
if( *(_DWORD *)a4 != 40 )
return;
v12 = *(_DWORD **)(a4 + 16);
if( !v12 )
return;
if( !v10
|| !a3
|| *(_DWORD *)a3 != 56
|| (v13 = *(_DWORD **)(a4 + 8)) == 0i64
|| (v14 = *(_DWORD **)(a3 + 8)) != 0i64 && (*v14 != 16 || (v14[1] & 0xFFFFFFF8) != 0)
|| a5 && *(_DWORD *)a5 != 96 )
{
*v12 = -1073741811;
return;
}
*v13 = 0;
**(_DWORD **)(a4 + 16) = -1073741790;
v15 = *(_QWORD **)(a4 + 32);
v188 = 0;
v200 = -1073741790;
if( v15 )
*v15 = 0i64;
v16 = *(ACCESS_REASONS **)(a4 + 24);
v196 = *(_DWORD *)(a3 + 16) & ~*(_DWORD *)(a3 + 20) & 0xFDFFFFFF;
v17 = v196;
AuthzBasepSetAccessReasons(v196, 0i64, 0i64, v16, 1u);
if( a6 == v19 )
{
v74 = *(_DWORD *)(a3 + 16);
v75 = *(int **)(a4 + 8);
if( (v74 & 0x2000000) != 0 )
{
*v75 = *(_DWORD *)(*(_QWORD *)(a3 + 32) + 12i64);
**(_DWORD **)(a4 + 8) |= *(_DWORD *)(a3 + 16) & 0xFDFFFFFF;
**(_DWORD **)(a4 + 8) |= *(_DWORD *)(a3 + 20);
}
else
{
*v75 = *(_DWORD *)(a3 + 20) | v74;
}
**(_DWORD **)(a4 + 16) = 0;
return;
}
v20 = *(_QWORD *)(a3 + 8);
if( !v20 || !*(_QWORD *)(v20 + 8) )
{
**(_DWORD **)(a4 + 16) = -1073741790;
return;
}
if( v10->ClientToken && v10->ImpersonationLevel < SecurityImpersonation )
{
**(_DWORD **)(a4 + 16) = -1073741659;
return;
}
if( !*(_DWORD *)(a3 + 16) )
{
v76 = *(_DWORD *)(a3 + 20);
if( v76 )
{
**(_DWORD **)(a4 + 8) = v76;
**(_DWORD **)(a4 + 16) = 0;
v77 = *(_QWORD **)(a4 + 32);
if( v77 )
*v77 = 0i64;
}
else
{
**(_DWORD **)(a4 + 16) = -1073741790;
}
return;
}
v21 = *(_DWORD *)(a4 + 4);
if( v21 != 1 && v21 != *(_DWORD *)(a3 + 40) )
{
**(_DWORD **)(a4 + 16) = -1073741811;
return;
}
if( !a2 )
{
SeLockSubjectContext(v10);
v20 = *(_QWORD *)(a3 + 8);
}
v22 = SepTrustLevelCheck(v18, *(VOID **)(v20 + 8), v10, 0i64, 0i64, 0, &v194);
v23 = 0i64;
**(_DWORD **)(a4 + 16) = v22;
v24 = *(int **)(a4 + 16);
if( *v24 < 0 )
{
v78 = a2 == 0;
goto LABEL_119;
}
v25 = v194;
*v24 = (*(_DWORD *)(a3 + 16) & 0xFDFFFFFF) != ((unsigned int)v194 & *(_DWORD *)(a3 + 16) & 0xFDFFFFFF) ? 0xC0000022 : 0;
v26 = *(int **)(a4 + 16);
ClientToken = (__int64)v10->ClientToken;
InputToken = v10->ClientToken;
if( *v26 < 0 )
{
if( !ClientToken )
InputToken = v10->PrimaryToken;
v79 = *(_QWORD *)(a3 + 8);
LODWORD(v80) = SepLocateTokenTrustLevel(v10);
SeLogAccessFailure(InputToken, 0i64, 0i64, v80, *(_QWORD *)(v79 + 8));
if( !a2 )
SeUnlockSubjectContext(v10);
OverWrite = 0;
v81 = v196 & ~v25;
v82 = 9437184i64;
goto LABEL_107;
}
if( !ClientToken )
{
ClientToken = (__int64)v10->PrimaryToken;
InputToken = (VOID *)ClientToken;
}
v28 = *(_QWORD *)(a3 + 8);
if( (*(_DWORD *)(v28 + 4) & 4) == 0 )
{
v29 = SepFilterCheck(*(_QWORD *)(v28 + 8), (__int64 *)&P, ClientToken, 0, (char *)&v202);
v23 = 0i64;
**(_DWORD **)(a4 + 16) = v29;
v30 = *(int **)(a4 + 16);
if( *v30 < 0 )
goto LABEL_118;
v31 = v202;
*v30 = (*(_DWORD *)(a3 + 16) & 0xFDFFFFFF) != (v202 & *(_DWORD *)(a3 + 16) & 0xFDFFFFFF) ? 0xC0000022 : 0;
if( **(int **)(a4 + 16) < 0 )
{
SeLogAccessFailure((VOID *)ClientToken, 0i64, 0i64, 0i64, *(_QWORD *)(*(_QWORD *)(a3 + 8) + 8i64));
if( !a2 )
SeUnlockSubjectContext(v10);
v81 = v17 & v31;
OverWrite = 0;
v82 = 10485760i64;
LABEL_107:
v83 = v81;
goto LABEL_109;
}
}
v32 = *(_QWORD *)(a3 + 8);
v33 = *(_DWORD *)(v32 + 4);
v34 = v33 & 1;
v180 = v33 & 1;
if( (v33 & 2) != 0 )
{
LOBYTE(v35) = 1;
if( (*(_DWORD *)(ClientToken + 200) & 0x2000) != 0 )
{
v36 = 1;
goto LABEL_34;
}
}
else
{
LOBYTE(v35) = 0;
}
v36 = 0;
LABEL_34:
v181 = v36;
if( !SepAllowAccessUponLogoff && (*(_DWORD *)(ClientToken + 200) & 0x20) == 0 )
{
v84 = *(_QWORD *)(ClientToken + 216);
if( v84 )
{
if( (*(_DWORD *)(v84 + 32) & 0x20) != 0 )
{
**(_DWORD **)(a4 + 8) = 0;
**(_DWORD **)(a4 + 16) = -1073741790;
goto LABEL_118;
}
}
}
LOBYTE(v190) = 0;
if( !v36 )
{
**(_DWORD **)(a4 + 16) = SepMandatoryIntegrityCheck(
*(int **)(a3 + 32),
*(_QWORD *)(v32 + 8),
(char)v35,
ClientToken,
0,
a8,
(__int64)v203);
if( **(int **)(a4 + 16) >= 0 )
{
v37 = SepMandatoryToDiscretionary(v203, *(_DWORD *)(a3 + 16));
*v35 = v37;
if( **(_DWORD **)(a4 + 16) >= (int)v23 )
{
if( (*(_DWORD *)(a3 + 16) & 0x2000000) != 0 && (*(_DWORD *)(ClientToken + 200) & 0x4000) != 0 )
{
v85 = (unsigned __int8)v190;
if( HIDWORD(v203[1]) <= 0x2000 )
v85 = 1;
v190 = v85;
}
goto LABEL_40;
}
if( (*(_DWORD *)(ClientToken + 200) & 0x4000) != 0 && HIDWORD(v203[1]) <= 0x2000 )
{
LOBYTE(v190) = 1;
goto LABEL_40;
}
if( a2 == (_BYTE)v23 )
{
SeUnlockSubjectContext(v10);
LOBYTE(v23) = 0;
}
v82 = 3145728i64;
OverWrite = (unsigned __int8)v23;
v83 = v17 & ~LODWORD(v203[0]);
LABEL_109:
AuthzBasepSetAccessReasons(v83, v82, 0i64, *(ACCESS_REASONS **)(a4 + 24), OverWrite);
return;
}
LABEL_118:
v78 = a2 == 0;
LABEL_119:
if( v78 )
SeUnlockSubjectContext(v10);
return;
}
LABEL_40:
if( !SepRmEnforceCap )
goto LABEL_41;
v86 = *(_QWORD *)(*(_QWORD *)(a3 + 8) + 8i64);
v87 = *(_WORD *)(v86 + 2);
if( (v87 & 0x10) == 0 || KeGetCurrentIrql() >= 2u )
goto LABEL_41;
if( v87 >= 0 )
{
v89 = *(ACL **)(v86 + 24);
}
else
{
v88 = *(unsigned int *)(v86 + 12);
if( !(_DWORD)v88 )
{
Sacl = v23;
goto LABEL_41;
}
v89 = (ACL *)(v86 + v88);
}
Sacl = v89;
if( v89 )
{
LODWORD(v90) = SepGetScopedPolicySid(v89);
v23 = 0i64;
if( v90 )
{
Cap = SepRmReferenceFindCap(v90, &v191);
v92 = v191;
v23 = 0i64;
v93 = Cap < 0;
v38 = 1;
v176 = 1;
if( v93 )
v92 = (RTL_DYNAMIC_HASH_TABLE_ENTRY *)SepRmDefaultCap;
v191 = v92;
}
else
{
v38 = 0;
}
goto LABEL_42;
}
LABEL_41:
v38 = 0;
LABEL_42:
if( !v34 || (v40 = *(_DWORD *)(a3 + 16), (v40 & 0x2060000) != 0) || v38 )
{
IsOwner = SepTokenIsOwner((PVOID)ClientToken, *(PVOID *)(*(_QWORD *)(a3 + 8) + 8i64), (UINT8)v35);
v40 = *(_DWORD *)(a3 + 16);
v23 = 0i64;
}
else
{
IsOwner = (unsigned __int8)v23;
}
BYTE1(v178) = IsOwner;
v41 = v40;
if( !IsOwner || (v40 & 0x2060000) == 0 )
goto LABEL_45;
v63 = v180;
if( v180 )
goto LABEL_147;
v64 = *(_QWORD *)(*(_QWORD *)(a3 + 8) + 8i64);
v65 = *(_WORD *)(v64 + 2);
if( (v65 & 4) == 0 )
goto LABEL_145;
if( v65 >= 0 )
{
v67 = *(ACL **)(v64 + 32);
goto LABEL_79;
}
v66 = *(unsigned int *)(v64 + 16);
if( (_DWORD)v66 )
v67 = (ACL *)(v64 + v66);
else
LABEL_145:
v67 = v23;
LABEL_79:
v68 = RtlpOwnerAcesPresent(0, v67);
v23 = 0i64;
if( !v68 )
goto LABEL_80;
v63 = 0;
LABEL_147:
v41 = v40;
if( !v63 )
{
LABEL_45:
v42 = v176;
goto LABEL_46;
}
LABEL_80:
v69 = 393216i64;
v70 = *(_DWORD *)(a3 + 16);
v71 = v70 & 0x60000;
v40 = 393216;
v72 = v70 & 0x2000000;
if( !v72 )
v40 = v71;
v73 = v17 & 0x60000;
*(_DWORD *)(a3 + 20) |= v40;
if( !v72 )
v69 = v73;
AuthzBasepSetAccessReasons(v69, 0x400000ui64, 0i64, *(ACCESS_REASONS **)(a4 + 24), (UINT8)v23);
v23 = 0i64;
v42 = v176;
v41 = *(_DWORD *)(a3 + 16) & 0xFFF9FFFF;
*(_DWORD *)(a3 + 16) = v41;
if( !v176 )
{
BYTE1(v178) = 0;
goto LABEL_47;
}
LABEL_46:
v43 = BYTE1(v178);
LABEL_47:
if( !v41 && !v42 && ((*(_DWORD *)(ClientToken + 200) & 0x2000) != 0 || !v40) )
{
if( a2 == (_BYTE)v23 )
{
SeUnlockSubjectContext(v10);
LODWORD(v23) = 0;
}
**(_DWORD **)(a4 + 8) = *(_DWORD *)(a3 + 20);
**(_DWORD **)(a4 + 16) = (_DWORD)v23;
return;
}
v44 = *(_QWORD *)(a3 + 8);
v45 = (__int64)v10->ClientToken;
v175 = v43;
PrimaryToken = (__int64)v10->PrimaryToken;
LOBYTE(v173) = (_BYTE)v23;
v172 = *(_QWORD *)(a4 + 24);
v171 = *(int **)(a4 + 16);
v170 = *(LUID ***)(a4 + 32);
v169 = *(int **)(a4 + 8);
v168 = *(_DWORD *)(a3 + 20);
v165 = *(_DWORD **)(a3 + 32);
*(_OWORD *)&v210[1] = 0i64;
v211 = v23;
v210[0] = v40;
v47 = SepAccessCheckEx(
*(_QWORD *)(v44 + 8),
0i64,
PrimaryToken,
v45,
v41,
(__int128 *)v23,
(int)v23,
v165,
v168,
a6,
v169,
v170,
v171,
v172,
v173,
v175,
a7,
(__int64)v210,
(__int64 *)&P,
(bool *)&v178);
v48 = v191;
v180 = v47;
if( !SepRmEnforceCap )
goto LABEL_49;
v196 = **(_DWORD **)(a4 + 16);
if( (v196 & 0x80000000) != 0 || !v176 )
goto LABEL_49;
v94 = *(int **)(a4 + 8);
v95 = 0i64;
LOBYTE(v186) = 0;
v96 = 0;
v187 = 0;
v97 = *v94;
v98 = *(unsigned int ***)(a4 + 32);
v193 = v97;
v189 = v97;
if( v98 )
{
v99 = *v98;
if( v99 )
{
v100 = *v99;
if( *v99 )
{
v101 = v99 + 3;
v102 = v100;
do
{
if( (int)v101[1] < 0 )
{
if( *(_QWORD *)(v101 - 1) == *(_QWORD *)SeSecurityPrivilege )
{
v96 |= 0x1000000u;
}
else if( *(_QWORD *)(v101 - 1) == SeTakeOwnershipPrivilege || *(_QWORD *)(v101 - 1) == SeRelabelPrivilege )
{
v96 |= 0x80000u;
}
}
v101 += 3;
--v102;
}
while( v102 );
v187 = v96;
}
}
}
v183 = v97;
BYTE2(v178) = SepAdtAuditThisEventWithContext(0x81ui64, 1u, 1u, v10);
v103 = BYTE2(v178);
if( BYTE2(v178) )
{
PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, 8i64 * HIDWORD(v48[2].Linkage.Blink), 0x41536553ui64);
v95 = PoolWithTag;
if( !PoolWithTag )
{
if( !a2 )
SeUnlockSubjectContext(v10);
Blink = (volatile INT64 *)v48[1].Linkage.Blink;
if( Blink )
SepRmDereferenceCapTable(Blink);
**(_DWORD **)(a4 + 8) = 0;
**(_DWORD **)(a4 + 16) = -1073741801;
SepFreeResourceInfo(P);
return;
}
memset((INT64)PoolWithTag, 0i64);
v103 = BYTE2(v178);
}
Blink_high = HIDWORD(v48[2].Linkage.Blink);
v107 = 0;
LODWORD(Data) = 0;
LODWORD(v195) = Blink_high;
if( !Blink_high )
{
LABEL_238:
if( v103 )
{
if( v189 != v193 )
{
v143 = v189 & (v193 ^ v189);
v144 = v193 & (v193 ^ v189);
v145 = 0;
v183 = v144;
v186 = 0;
if( Blink_high )
{
v146 = v95;
do
{
if( !v143 && !v144 )
break;
if( v146[4] )
{
v147 = *(_DWORD *)v146;
v148 = v145 << 24;
v149 = v144 ^ *(_DWORD *)v146;
LODWORD(Data) = *(_DWORD *)v146;
v150 = v144 & v149;
if( v150 )
{
AuthzBasepSetAccessReasons(v150, 0x80000000ui64, v148, &v216, 0);
v147 = Data;
v144 = v183;
}
v151 = v143 & v147;
v183 = ~v150 & v144;
LODWORD(Data) = v151;
if( v151 )
{
AuthzBasepSetAccessReasons(v151, 0x80000000ui64, v148, &v216, 0);
v151 = Data;
}
v143 &= ~v151;
AuthzBasepMergeAccessReasons((ACCESS_REASONS *)result, &v216, 0xFF000000ui64);
v144 = v183;
v145 = v186;
Blink_high = v195;
}
++v145;
v146 += 8;
v186 = v145;
}
while( v145 < Blink_high );
v10 = v205;
}
}
}
if( v95 )
ExFreePoolWithTag(v95, 0);
**(_DWORD **)(a4 + 16) = v196;
**(_DWORD **)(a4 + 8) &= v193;
v152 = v178;
if( **(int **)(a4 + 16) < 0 )
v152 = 0;
LOBYTE(v178) = v152;
AuthzBasepMergeAccessReasons(*(ACCESS_REASONS **)(a4 + 24), (ACCESS_REASONS *)result, 0i64);
AuthzBasepMergeAccessReasons(*(ACCESS_REASONS **)(a4 + 24), (ACCESS_REASONS *)result, 0xFF000000ui64);
LABEL_49:
if( v181 || (v49 = *(unsigned int *)(a3 + 16), (v49 & 0x2000000) == 0) )
{
if( (_BYTE)v190 && !*(_WORD *)((char *)&v211 + 1) )
{
**(_DWORD **)(a4 + 16) = -1073741790;
**(_DWORD **)(a4 + 8) = 0;
v156 = *(_DWORD **)(a4 + 8);
v157 = *(ACCESS_REASONS **)(a4 + 24);
LOBYTE(v178) = 0;
AuthzBasepSetAccessReasons((unsigned int)~*v156, 0x300000ui64, 0i64, v157, 0);
}
}
else
{
v50 = *(CHAR **)(a4 + 8);
v51 = *(_DWORD *)v50;
if( !(_BYTE)v190 || !*(_WORD *)((char *)&v211 + 1) )
{
LODWORD(v164) = 0;
SepConstrainByMandatory((INT64)v203, v49, v50, *(CHAR **)(a4 + 16), &v178, v164);
AuthzBasepSetAccessReasons(
v51 & (unsigned int)~**(_DWORD **)(a4 + 8),
0x300000ui64,
0i64,
*(ACCESS_REASONS **)(a4 + 24),
0);
}
}
if( (*(_DWORD *)(a3 + 16) & 0x2000000) != 0 )
{
v52 = *(int **)(a4 + 8);
v53 = *(_DWORD **)(a4 + 16);
v54 = *v52;
if( (_DWORD)v194 == -1 || (v158 = v194 & v54, ((unsigned int)v194 & v54) == v54) )
{
v55 = 0;
}
else
{
*v52 = v158;
v55 = 1;
if( v158 )
{
*v53 = 0;
LOBYTE(v178) = 1;
}
else
{
*v53 = -1073741790;
LOBYTE(v178) = 0;
}
}
AuthzBasepSetAccessReasons(
v54 & (unsigned int)~**(_DWORD **)(a4 + 8),
0x900000ui64,
0i64,
*(ACCESS_REASONS **)(a4 + 24),
0);
v56 = *(int **)(a4 + 8);
v57 = *(_DWORD **)(a4 + 16);
v58 = *(_DWORD *)(a3 + 16);
v179 = 0;
v59 = *v56;
if( v202 == -1 || (v159 = v59 & v202, (v59 & v202) == v59) )
{
v60 = v179;
}
else
{
*v56 = v159;
v60 = 1;
if( (v58 & 0x2000000) != 0 )
{
*v57 = v159 == 0 ? 0xC0000022 : 0;
LOBYTE(v178) = v159 != 0;
}
else
{
*v57 = -1073741790;
LOBYTE(v178) = *v56 != 0;
}
}
AuthzBasepSetAccessReasons(
v59 & (unsigned int)~**(_DWORD **)(a4 + 8),
0xA00000ui64,
0i64,
*(ACCESS_REASONS **)(a4 + 24),
0);
}
else
{
v55 = HIBYTE(v178);
v60 = HIBYTE(v178);
}
v61 = InputToken;
if( InputToken )
{
if( v55
|| v60
|| (v62 = v210[3]) == 0
&& (*((_DWORD *)InputToken + 50) & 0x4000) != 0
&& (**(int **)(a4 + 16) < 0 || BYTE3(v211)) )
{
v160 = *(_QWORD *)(a3 + 8);
LODWORD(v161) = SepLocateTokenTrustLevel(v10);
SeLogAccessFailure(InputToken, 0i64, 0i64, v161, *(_QWORD *)(v160 + 8));
v62 = v210[3];
v61 = InputToken;
}
if( **(int **)(a4 + 16) < 0
&& !v62
&& (v61[50] & 0x4000) != 0
&& SepLpacCausedAccessFailure((INT64)v210, *(unsigned int *)(a3 + 16)) )
{
SepLogLpacAccessFailure();
}
}
if( v176 )
{
v162 = v191[1].Linkage.Blink;
if( v162 )
SepRmDereferenceCapTable((volatile INT64 *)v162);
}
if( !a2 )
SeUnlockSubjectContext(v10);
SepFreeResourceInfo(P);
return;
}
while( 1 )
{
v212 = 0i64;
v204 = v107;
v213 = 0i64;
v214 = 0i64;
v195 = *(&v48[2].Signature + v107);
if( !*(_QWORD *)(v195 + 24) )
goto LABEL_214;
v108 = P;
if( !P )
{
v109 = AuthzBasepInitializeResourceClaimsFromSacl((__int64)Sacl, (__int64)&P);
v108 = P;
v110 = (unsigned __int8)v186;
if( v109 < 0 )
v110 = 1;
v186 = v110;
}
v111 = *(_QWORD **)(ClientToken + 1096);
v112 = v111 ? v111[75] : 0i64;
v113 = v111 ? v111[73] : 0i64;
v114 = v111 ? v111[74] : 0i64;
v115 = v111 ? v111[72] : 0i64;
v116 = AuthzBasepEvaluateAceCondition(
ClientToken,
*(_QWORD *)(ClientToken + 776),
(__int64)v108,
v115,
v114,
v113,
v112,
*(char **)(v195 + 24),
*(_DWORD *)(v195 + 16),
1,
0,
&v192);
v117 = v192;
v118 = v116;
if( v192 == 1 )
goto LABEL_214;
if( v116 < 0 )
goto LABEL_257;
if( (*(_DWORD *)(ClientToken + 200) & 0x10) != 0 )
break;
LABEL_212:
if( !(_BYTE)v186 && v117 != 1 )
goto LABEL_236;
LABEL_214:
v118 = SepBuildCapeSecurityDescriptor(SecurityDescriptor, *(PVOID *)(v195 + 32), Sacl);
if( v118 < 0 )
{
if( !a2 )
SeUnlockSubjectContext(v10);
v155 = v191[1].Linkage.Blink;
if( v155 )
SepRmDereferenceCapTable((volatile INT64 *)v155);
**(_DWORD **)(a4 + 8) = 0;
goto LABEL_268;
}
v124 = *(_DWORD *)(a3 + 16);
if( (*(_DWORD *)(v195 + 48) & 1) != 0 )
{
if( (v124 & 0x2000000) == 0 )
v124 |= *(_DWORD *)(a3 + 20);
v125 = 0;
}
else
{
v125 = *(_DWORD *)(a3 + 20);
}
v126 = (__int64)v10->ClientToken;
v127 = (__int64)v10->PrimaryToken;
LOBYTE(v174) = 0;
v166 = *(_DWORD **)(a3 + 32);
v212 = 0i64;
v213 = 0i64;
v214 = 0i64;
v128 = SepAccessCheckEx(
(__int64)SecurityDescriptor,
0i64,
v127,
v126,
v124 | 0x2000000,
&v212,
1,
v166,
v125,
a6,
&v188,
0i64,
&v200,
(__int64)v217,
v174,
SBYTE1(v178),
a7,
(__int64)v210,
(__int64 *)&P,
(bool *)&v178);
v129 = v187;
v180 = v128;
v130 = v188 & (v125 | **(_DWORD **)(a4 + 8));
v131 = v187 | HIDWORD(v213);
v188 = v130;
if( BYTE1(v178) )
v131 |= v130 & 0x60000;
v132 = ~(_DWORD)v214 & v131;
v133 = v200;
v193 &= v130;
if( !v193 )
v133 = -1073741790;
v196 = v133;
if( (v183 & (v183 ^ v132)) != 0 )
{
AuthzBasepSetAccessReasons(v183 & (v183 ^ v132), 0x50000ui64, (unsigned int)Data, (ACCESS_REASONS *)result, 0);
v183 &= v132;
v129 = v187;
}
v103 = BYTE2(v178);
if( BYTE2(v178) )
{
v134 = *(void **)(v195 + 40);
if( v134 )
{
v118 = SepBuildCapeSecurityDescriptor(CapeSecurityDescriptor, v134, Sacl);
if( v118 < 0 )
{
if( !a2 )
SeUnlockSubjectContext(v10);
v154 = v191[1].Linkage.Blink;
if( v154 )
SepRmDereferenceCapTable((volatile INT64 *)v154);
**(_DWORD **)(a4 + 8) = 0;
goto LABEL_268;
}
v135 = *(_DWORD *)(a3 + 16);
if( (*(_DWORD *)(v195 + 48) & 0x100) != 0 )
{
if( (v135 & 0x2000000) == 0 )
v135 |= *(_DWORD *)(a3 + 20);
v136 = 0;
}
else
{
v136 = *(_DWORD *)(a3 + 20);
}
v137 = (__int64)v10->ClientToken;
LOBYTE(v174) = 0;
v167 = *(_DWORD **)(a3 + 32);
v138 = (__int64)v10->PrimaryToken;
v212 = 0i64;
v213 = 0i64;
v214 = 0i64;
SepAccessCheckEx(
(__int64)CapeSecurityDescriptor,
0i64,
v138,
v137,
v135,
0i64,
0,
v167,
v136,
a6,
&v197,
0i64,
&v201,
(__int64)v217,
v174,
SBYTE1(v178),
a7,
(__int64)v210,
(__int64 *)&P,
&v182);
v139 = v204;
v140 = v189;
v141 = v187;
v95[8 * v204 + 4] = 1;
*(_DWORD *)&v95[8 * v139] = v197 | v141;
v189 = v197 & v140;
}
else
{
v142 = v204;
v95[8 * v204 + 4] = 1;
*(_DWORD *)&v95[8 * v142] = v188 | v129;
v189 &= v188;
}
LABEL_236:
v103 = BYTE2(v178);
}
v48 = v191;
v107 = Data + 1;
LODWORD(Data) = v107;
Blink_high = HIDWORD(v191[2].Linkage.Blink);
LODWORD(v195) = Blink_high;
if( v107 >= Blink_high )
goto LABEL_238;
}
v119 = *(_QWORD **)(ClientToken + 1096);
if( v119 )
v120 = v119[75];
else
v120 = 0i64;
if( v119 )
v121 = v119[73];
else
v121 = 0i64;
if( v119 )
v122 = v119[74];
else
v122 = 0i64;
if( v119 )
v123 = v119[72];
else
v123 = 0i64;
v118 = AuthzBasepEvaluateAceCondition(
ClientToken,
*(_QWORD *)(ClientToken + 776),
(__int64)P,
v123,
v122,
v121,
v120,
*(char **)(v195 + 24),
*(_DWORD *)(v195 + 16),
1,
1,
&v192);
if( v118 >= 0 )
{
v117 = v192;
goto LABEL_212;
}
LABEL_257:
if( !a2 )
SeUnlockSubjectContext(v10);
v153 = v191[1].Linkage.Blink;
if( v153 )
SepRmDereferenceCapTable((volatile INT64 *)v153);
**(_DWORD **)(a4 + 8) = 0;
LABEL_268:
**(_DWORD **)(a4 + 16) = v118;
SepFreeResourceInfo(P);
if( v95 )
ExFreePoolWithTag(v95, 0);
}Referenced by:
SepCommonAccessCheckEx