SepVerifyDesktopAppxImage

NTSTATUS __stdcall SepVerifyDesktopAppxImage(
        _EPROCESS *Process,
        VOID *Token,
        UINT8 VerifyTLAce,
        _BYTE *PackageVerified){
  char *v7; 
  unsigned int Flags3; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *TrustLabelAce; 
  int v10; 
  NTSTATUS SecurityObject; 
  VOID **PoolWithTag; 
  char PackageNameVerified[4]; 
  char NumberOfBytes[12]; 
  char SecurityDescriptor[512]; 

  *PackageVerified = 0;
  v7 = 0i64;
  Flags3 = Process->Flags3;
  TrustLabelAce = 0i64;
  *(_QWORD *)&NumberOfBytes[4] = 0i64;
  PackageNameVerified[0] = 0;
  if( (Flags3 & 1) != 0 )
    return 0;
  v10 = PsReferenceProcessFilePointer(Process, (VOID **)&NumberOfBytes[4]);
  if( v10 >= 0 )
  {
    *(_DWORD *)NumberOfBytes = 512;
    v7 = SecurityDescriptor;
    v10 = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    if( v10 >= 0 )
    {
      SecurityObject = ObQuerySecurityObject(
                         *(VOID **)&NumberOfBytes[4],
                         0x84ui64,
                         SecurityDescriptor,
                         0x200ui64,
                         (UINT64 *)NumberOfBytes);
      if( SecurityObject == -1073741789 )
      {
        PoolWithTag = ExAllocatePoolWithTag(1ui64, *(unsigned int *)NumberOfBytes, 538994003i64);
        v7 = (char *)PoolWithTag;
        if( !PoolWithTag )
        {
          v10 = -1073741801;
          goto LABEL_23;
        }
        v10 = RtlCreateSecurityDescriptor(PoolWithTag, 1ui64);
        if( v10 < 0 )
          goto LABEL_23;
        SecurityObject = ObQuerySecurityObject(
                           *(VOID **)&NumberOfBytes[4],
                           0x84ui64,
                           v7,
                           *(unsigned int *)NumberOfBytes,
                           (UINT64 *)NumberOfBytes);
      }
      if( SecurityObject < 0 )
      {
        v10 = 0;
        goto LABEL_23;
      }
      if( !v7 )
      {
        v10 = -1073739509;
        goto LABEL_23;
      }
      v10 = SepVerifyDesktopAppxPackageName(Token, v7, PackageNameVerified);
      if( v10 >= 0 && VerifyTLAce == 1 )
        TrustLabelAce = SeGetTrustLabelAce(v7);
      if( PackageNameVerified[0] != 1 )
        goto LABEL_23;
      if( VerifyTLAce == 1 )
      {
        if( TrustLabelAce )
          goto LABEL_22;
        v10 = -1073740702;
      }
      if( VerifyTLAce )
        goto LABEL_23;
LABEL_22:
      *PackageVerified = 1;
    }
  }
LABEL_23:
  if( *(_QWORD *)&NumberOfBytes[4] )
    ObfDereferenceObjectWithTag(*(VOID **)&NumberOfBytes[4], 0x746C6644ui64);
  if( v7 && v7 != SecurityDescriptor )
    ExFreePoolWithTag(v7, 0);
  return v10;
}

Referenced by: