SepMandatorySubProcessToken

INT64 __fastcall SepMandatorySubProcessToken(
        _TOKEN *ParentToken,
        _TOKEN *Token,
        _EPROCESS *Process,
        VOID **pNewIntegritySid){
  int v4; 
  VOID **v5; 
  int v6; 
  int SecurityObject; 
  VOID *v10; 
  char *v11; 
  __int16 v12; 
  __int64 v13; 
  ACL *v14; 
  __int64 v15; 
  char *PoolWithTag; 
  unsigned __int8 *v18; 
  PVOID *TokenIntegrity; 
  PVOID *v20; 
  int v21; 
  int v22; 
  PVOID v23; 
  int v24; 
  unsigned int v25; 
  unsigned int TokenFlags; 
  unsigned int v27; 
  INT64 v28; 
  VOID **v29; 
  void *v30; 
  __int64 v31; 
  int v32; 
  __int64 *v33; 
  INT64 v34; 
  __int64 v35; 
  int v36; 
  unsigned int v37; 
  __int64 v38; 
  int v39; 
  unsigned int v40; 
  int v41; 
  _QWORD *v42; 
  int v43; 
  unsigned int v44; 
  unsigned int v45; 
  unsigned int v46; 
  UINT8 pbDominate[4]; 
  char NumberOfBytes[12]; 
  VOID *Object; 
  char SecurityDescriptor[128]; 
  v4 = 0;
  *(_QWORD *)&NumberOfBytes[4] = pNewIntegritySid;
  *pNewIntegritySid = 0i64;
  v5 = pNewIntegritySid;
  v6 = *((_DWORD *)Process + 543);
  Object = 0i64;
  pbDominate[0] = 0;
  SecurityObject = 0;
  v10 = 0i64;
  v11 = 0i64;
  if( (v6 & 1) != 0 || (Token->MandatoryPolicy & 2) == 0 )
    goto LABEL_13;
  SecurityObject = PsReferenceProcessFilePointer((struct _EX_RUNDOWN_REF *)Process, (unsigned __int64 *)&Object);
  if( SecurityObject < 0
    || (*(_DWORD *)NumberOfBytes = 128,
        v11 = SecurityDescriptor,
        SecurityObject = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64),
        SecurityObject < 0) )
  {
    v10 = Object;
    goto LABEL_15;
  }
  v10 = Object;
  SecurityObject = ObQuerySecurityObject(Object, 0x10ui64, SecurityDescriptor, 0x80ui64, (UINT64 *)NumberOfBytes);
  if( SecurityObject != -1073741789 )
  {
LABEL_6:
    if( SecurityObject >= 0 && v11 )
    {
      v12 = *((_WORD *)v11 + 1);
      if( (v12 & 0x10) != 0 )
      {
        if( v12 >= 0 )
        {
          v14 = (ACL *)*((_QWORD *)v11 + 3);
LABEL_12:
          LODWORD(v15) = RtlFindAceByType(v14, 0x11ui64, 0i64);
          if( v15 )
          {
            v18 = (unsigned __int8 *)(v15 + 8);
            TokenIntegrity = (PVOID *)SepLocateTokenIntegrity((INT64)Token);
            v20 = TokenIntegrity;
            if( !TokenIntegrity )
              goto LABEL_42;
            SecurityObject = RtlSidDominates(*TokenIntegrity, v18, pbDominate);
            if( SecurityObject < 0 )
              goto LABEL_15;
            if( pbDominate[0] )
            {
              v21 = v18[1];
              if( (_BYTE)v21 )
                v22 = *(_DWORD *)&v18[4 * (v21 - 1) + 8];
              else
                v22 = 0;
              *((_DWORD *)*v20 + 2) = v22;
              v23 = *v20;
              v4 = 0;
              **(_QWORD **)&NumberOfBytes[4] = v23;
              v24 = v18[1];
              if( (_BYTE)v24 )
                v25 = *(_DWORD *)&v18[4 * (v24 - 1) + 8];
              else
                v25 = 0;
              TokenFlags = Token->TokenFlags;
              v5 = *(VOID ***)&NumberOfBytes[4];
              if( v25 >= 0x2000 )
                v27 = TokenFlags | 0x2000;
              else
                v27 = TokenFlags & 0xFFFFDFFF;
              Token->TokenFlags = v27;
            }
            else
            {
LABEL_42:
              v5 = *(VOID ***)&NumberOfBytes[4];
              v4 = 0;
            }
          }
          goto LABEL_13;
        }
        v13 = *((unsigned int *)v11 + 3);
        if( (_DWORD)v13 )
        {
          v14 = (ACL *)&v11[v13];
          goto LABEL_12;
        }
      }
      v14 = 0i64;
      goto LABEL_12;
    }
    SecurityObject = 0;
LABEL_13:
    if( ParentToken )
    {
      if( (ParentToken->TokenFlags & 0x1000) != 0 && !SeTokenIsAdmin(ParentToken) )
      {
        Token->TokenFlags &= ~0x1000u;
        v28 = SepLocateTokenIntegrity((INT64)Token);
        v29 = (VOID **)v28;
        if( v28 )
        {
          v30 = Token->LogonSession->Token;
          if( v30 )
          {
            v34 = SepLocateTokenIntegrity((INT64)v30);
            if( v34 )
            {
              v35 = *v33;
              v36 = *(unsigned __int8 *)(*v33 + 1);
              v37 = (_BYTE)v36 ? *(_DWORD *)(v35 + 4i64 * (unsigned int)(v36 - 1) + 8) : 0;
              v38 = *(_QWORD *)v34;
              v39 = *(unsigned __int8 *)(*(_QWORD *)v34 + 1i64);
              if( (_BYTE)v39 )
              {
                v4 = *(unsigned __int8 *)(*(_QWORD *)v34 + 1i64);
                v40 = *(_DWORD *)(v38 + 4i64 * (unsigned int)(v39 - 1) + 8);
              }
              else
              {
                v40 = 0;
              }
              if( v37 > v40 )
              {
                if( (_BYTE)v39 )
                  v41 = *(_DWORD *)(v38 + 4i64 * (unsigned int)(v4 - 1) + 8);
                else
                  v41 = 0;
                v42 = *(_QWORD **)&NumberOfBytes[4];
                *(_DWORD *)(v35 + 8) = v41;
                *v42 = *v33;
                v43 = *(unsigned __int8 *)(*(_QWORD *)v34 + 1i64);
                if( (_BYTE)v43 )
                  v44 = *(_DWORD *)(*(_QWORD *)v34 + 4i64 * (unsigned int)(v43 - 1) + 8);
                else
                  v44 = 0;
                v45 = Token->TokenFlags;
                if( v44 >= 0x2000 )
                  v46 = v45 | 0x2000;
                else
                  v46 = v45 & 0xFFFFDFFF;
                Token->TokenFlags = v46;
              }
            }
          }
          else
          {
            v31 = *(_QWORD *)v28;
            v32 = *(unsigned __int8 *)(*(_QWORD *)v28 + 1i64);
            if( (_BYTE)v32 && *(_DWORD *)(v31 + 4i64 * (unsigned int)(v32 - 1) + 8) > 0x2000u )
            {
              *(_DWORD *)(v31 + 8) = 0x2000;
              *v5 = *v29;
            }
          }
        }
      }
    }
    goto LABEL_15;
  }
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, *(unsigned int *)NumberOfBytes, 0x20206553ui64);
  v11 = PoolWithTag;
  if( !PoolWithTag )
  {
    SecurityObject = -1073741801;
    goto LABEL_15;
  }
  SecurityObject = RtlCreateSecurityDescriptor(PoolWithTag, 1ui64);
  if( SecurityObject >= 0 )
  {
    SecurityObject = ObQuerySecurityObject(v10, 0x10ui64, v11, *(unsigned int *)NumberOfBytes, (UINT64 *)NumberOfBytes);
    goto LABEL_6;
  }
LABEL_15:
  if( v10 )
    ObfDereferenceObjectWithTag(v10, 0x746C6644ui64);
  if( v11 && v11 != SecurityDescriptor )
    ExFreePoolWithTag(v11, 0);
  return(unsigned int)SecurityObject;
}

Referenced by: