ObpVerifyAccessToBoundaryEntry

BOOL __fastcall ObpVerifyAccessToBoundaryEntry(INT64 *a1, INT64 a2){
  INT64 *v4; 
  int v5; 
  VOID **v6; 
  UINT64 v7; 
  INT64 v8; 
  PVOID *v10; 
  int v11; 
  UINT64 v12; 
  UCHAR AceType; 
  UCHAR AceTypea; 
  UINT64 AceTypeb; 
  PSID LabelSid; 
  PSID LabelSida; 
  PSID LabelSidb; 
  UINT64 GrantedAccess; 
  __int128 SecurityDescriptor[2]; 
  __int64 v21; 
  struct _ACL Sacl; 
  struct _ACL Acl; 
  memset((INT64)&Acl, 0i64);
  LODWORD(GrantedAccess) = 0;
  memset((INT64)&Sacl, 0i64);
  v4 = a1 + 1;
  v21 = 0i64;
  v5 = *(_DWORD *)a1;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  if( v5 != 2 )
  {
    if( v5 != 3 )
    {
      if( v5 != 1 )
      {
        *(_DWORD *)(a2 + 48) = -1073741595;
        return 0;
      }
      return 1;
    }
    RtlCreateAcl(&Sacl, 0x54u, 2u);
    LODWORD(LabelSid) = 7;
    RtlAddMandatoryAce(&Sacl, v12, 0i64, v4, AceType, (UINT64)LabelSid);
    RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    RtlSetSaclSecurityDescriptor(SecurityDescriptor, 1u, &Sacl, 0);
    goto LABEL_6;
  }
  if( !RtlIsPackageSid(v4) )
  {
    RtlCreateAcl(&Acl, 0xA0u, 2u);
    RtlpAddKnownAce(&Acl, 2ui64, 0i64, 0xF000Fui64, v4, 0);
    v6 = *(VOID ***)(a2 + 32);
    if( v6 )
      RtlpAddKnownAce(&Acl, 2ui64, 0i64, 0xF000Fui64, *v6, 0);
    RtlCreateAcl(&Sacl, 0x54u, 2u);
    LODWORD(LabelSida) = 7;
    RtlAddMandatoryAce(&Sacl, v7, 0i64, *(VOID **)(a2 + 40), AceTypea, (UINT64)LabelSida);
    RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, &Acl, 0);
    RtlSetSaclSecurityDescriptor(SecurityDescriptor, 1u, &Sacl, 0);
LABEL_6:
    LOBYTE(v8) = 1;
    LODWORD(LabelSidb) = 0;
    LODWORD(AceTypeb) = 983055;
    return SeAccessCheckWithHint(
             SecurityDescriptor,
             1ui64,
             (SECURITY_SUBJECT_CONTEXT *)a2,
             v8,
             AceTypeb,
             (UINT64)LabelSidb,
             0i64,
             &ObpDirectoryObjectType->TypeInfo.GenericMapping,
             *((_BYTE *)KeGetCurrentThread() + 562),
             &GrantedAccess,
             (INT64 *)(a2 + 48));
  }
  v10 = *(PVOID **)(a2 + 32);
  if( v10 && !RtlEqualSid(v4, *v10) )
  {
    *(_DWORD *)(a2 + 48) = -1073741790;
    return 0;
  }
  v11 = *(_DWORD *)(a2 + 52);
  if( (v11 & 1) != 0 )
  {
    *(_DWORD *)(a2 + 48) = -1073741811;
    return 0;
  }
  *(_DWORD *)(a2 + 52) = v11 | 1;
  return 1;
}

Referenced by: