IoCheckRedirectionTrustLevel

NTSTATUS __stdcall IoCheckRedirectionTrustLevel(INT64 a1, CHAR a2, _SECURITY_SUBJECT_CONTEXT *a3, INT64 a4, VOID *a5){
  int v5; 
  int v6; 
  BOOL v7; 
  char v8; 
  int v10; 
  _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  bool v12; 
  bool v13; 
  char v15; 
  BOOL v16; 
  char v17[6]; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  BOOL v19; 

  v16 = 0;
  v5 = 1;
  v19 = 1;
  v15 = 1;
  v6 = 1;
  v17[0] = 0;
  v7 = 1;
  v8 = 1;
  v10 = a1;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( !a2 || (a4 & 0xFFFFFFFD) == 0 )
    return 0;
  if( !a3 )
    SeCaptureSubjectContext((INT64)&SubjectContext);
  p_SubjectContext = &SubjectContext;
  if( a3 )
    p_SubjectContext = a3;
  SeTokenGetRedirectionTrustPolicy((INT64)p_SubjectContext->PrimaryToken, &v16, v17);
  if( p_SubjectContext->ClientToken && p_SubjectContext->ImpersonationLevel >= SecurityImpersonation )
  {
    SeTokenGetRedirectionTrustPolicy((INT64)p_SubjectContext->ClientToken, &v19, &v15);
    v7 = v19;
    v6 = 2;
    v8 = v15;
  }
  if( !a3 )
    SeReleaseSubjectContext(&SubjectContext);
  v12 = v16 && v7;
  v13 = v17[0] && v8;
  if( v12 )
  {
    v5 = 2;
  }
  else if( !v13 )
  {
    return 0;
  }
  EtwTimLogRedirectionTrustPolicy(
    v5,
    (const _EVENT_DESCRIPTOR *)KeGetCurrentThread()->ApcState.Process,
    v10,
    a5,
    v6 == 2);
  if( !v12 )
    return 0;
  return -1073740610;
}

Referenced by: