PspCombineSecurityDomains

NTSTATUS __stdcall PspCombineSecurityDomains(PVOID Object, PVOID a2){
  __int64 v4; 
  __int64 v5; 
  int v6; 
  NTSTATUS v7; 
  signed __int64 v9; 
  int v10[8]; 
  _GENERIC_MAPPING *GenericMapping; 
  VOID *v12; 
  VOID *Handle; 
  _SECURITY_SUBJECT_CONTEXT v14[5]; 
  _AUX_ACCESS_DATA AuxData; 

  memset(v14, 0i64, sizeof(v14));
  memset(&AuxData, 0i64, sizeof(AuxData));
  if( (*((_DWORD *)Object + 543) & 0x400000) == 0 || (*((_DWORD *)a2 + 543) & 0x400000) == 0 )
    return -1073741700;
  _InterlockedOr(v10, 0);
  v4 = *((_QWORD *)Object + 316);
  v5 = *((_QWORD *)a2 + 316);
  if( v4 == v5 )
    return 0;
  if( !v4 || !v5 || *((int *)Object + 628) < 0 || *((int *)a2 + 628) < 0 )
    return -1073740699;
  Handle = 0i64;
  v12 = 0i64;
  v6 = SeCreateAccessStateEx(
         0i64,
         (_KPROCESS *)a2,
         (_ACCESS_STATE *)v14,
         &AuxData,
         40,
         (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
  if( v6 >= 0 )
  {
    LOBYTE(GenericMapping) = 0;
    v7 = ObOpenObjectByPointer(
           Object,
           0x600ui64,
           (PACCESS_STATE)v14,
           0,
           (POBJECT_TYPE)PsProcessType,
           (_KPROCESSOR_MODE)GenericMapping,
           &Handle);
    v6 = v7;
    if( v7 >= 0 )
    {
      SepDeleteAccessState((_ACCESS_STATE *)v14);
      SeReleaseSubjectContext(&v14[1]);
      v6 = SeCreateAccessStateEx(
             0i64,
             (_KPROCESS *)Object,
             (_ACCESS_STATE *)v14,
             &AuxData,
             40,
             (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
      if( v6 < 0 )
        goto LABEL_14;
      LOBYTE(GenericMapping) = 0;
      v7 = ObOpenObjectByPointer(
             a2,
             0x600ui64,
             (PACCESS_STATE)v14,
             0,
             (POBJECT_TYPE)PsProcessType,
             (_KPROCESSOR_MODE)GenericMapping,
             &v12);
      v6 = v7;
      if( v7 >= 0 )
      {
        _InterlockedOr((volatile signed __int32 *)Object + 543, 0x200000u);
        *((_QWORD *)Object + 316) = *((_QWORD *)a2 + 316);
        if( (*((_DWORD *)Object + 628) | *((_DWORD *)a2 + 628)) < 0 )
        {
          v9 = _InterlockedIncrement64(&PsNextSecurityDomain);
          v6 = -1073740699;
          *((_QWORD *)Object + 316) = v9;
          *((_QWORD *)Object + 317) = v9;
        }
        KeSynchronizeSecurityDomain((_EPROCESS *)Object);
        goto LABEL_13;
      }
      v12 = 0i64;
    }
    else
    {
      Handle = 0i64;
    }
    if( v7 == -1073741790 )
      v6 = -1073740699;
LABEL_13:
    SepDeleteAccessState((_ACCESS_STATE *)v14);
    SeReleaseSubjectContext(&v14[1]);
  }
LABEL_14:
  if( v12 )
    ObCloseHandle(v12, 0);
  if( Handle )
    ObCloseHandle(Handle, 0);
  return v6;
}

Referenced by: