SepCheckCapabilities

NTSTATUS __stdcall SepCheckCapabilities(
        VOID *Token,
        UINT64 CapabilityCount,
        _SID_AND_ATTRIBUTES *Capabilities,
        UINT8 *Match,
        UINT8 *Matcha){
  unsigned int v5; 
  char v7; 
  int InformationToken; 
  UINT8 v10; 
  PVOID *v11; 
  char IsLpacCapabilitySid; 
  unsigned int v14; 
  void *Sid; 
  UINT8 v16; 
  _DWORD *v17; 
  INT64 v18; 
  _BYTE *v19; 
  const VOID *v20; 
  const VOID *v21; 
  const VOID *v22; 
  VOID *TokenInformation; 
  unsigned int i; 
  PVOID *v25; 
  PVOID P; 
  PVOID v27; 
  void *j; 
  unsigned int v29; 
  char v30; 

  v29 = CapabilityCount;
  v5 = 0;
  P = 0i64;
  v7 = 1;
  v27 = 0i64;
  v30 = 1;
  TokenInformation = 0i64;
  *Matcha = 0;
  InformationToken = SeQueryInformationToken(Token, TokenIsAppContainer, &TokenInformation);
  if( InformationToken >= 0 )
  {
    if( (_DWORD)TokenInformation )
    {
      InformationToken = SeQueryInformationToken(Token, TokenCapabilities, &P);
      if( InformationToken >= 0 )
      {
        InformationToken = SeQueryInformationToken(
                             Token,
                             MaxTokenInfoClass|TokenGroups,
                             (VOID **)((char *)&TokenInformation + 4));
        if( InformationToken >= 0 )
        {
          v10 = 1;
          v11 = (PVOID *)P;
          v25 = (PVOID *)P;
          for( i = 0; i < v29; ++i )
          {
            v10 = 0;
            if( HIDWORD(TokenInformation)
              || (IsLpacCapabilitySid = SepIsLpacCapabilitySid(Capabilities->Sid), v11 = v25, !IsLpacCapabilitySid) )
            {
              v14 = *(_DWORD *)P;
              if( *(_DWORD *)P )
              {
                Sid = Capabilities->Sid;
                for( j = Capabilities->Sid; ; Sid = j )
                {
                  v16 = RtlEqualSid(v11[2 * v5 + 1], Sid);
                  v11 = v25;
                  if( v16 && LODWORD(v25[2 * v5 + 2]) == Capabilities->Attributes )
                  {
                    v7 = v30;
                    v10 = 1;
                    v5 = 0;
                    goto LABEL_9;
                  }
                  if( ++v5 >= v14 )
                    break;
                }
                v7 = v30;
              }
              if( *((_BYTE *)Capabilities->Sid + 1) != 9 )
                break;
              LODWORD(v17) = RtlSubAuthoritySid((INT64)Capabilities->Sid, 0i64);
              if( *v17 != 3 )
                break;
              v5 = 0;
              if( !v27 )
              {
                InformationToken = SeQueryInformationToken(Token, TokenAppContainerSid, &v27);
                if( InformationToken < 0 )
                  goto LABEL_11;
              }
              v18 = *(_QWORD *)v27;
              LODWORD(v19) = RtlSubAuthorityCountSid(*(_QWORD *)v27);
              if( *v19 < 8u
                || (LODWORD(v20) = RtlSubAuthoritySid(v18, 1ui64),
                    v21 = v20,
                    LODWORD(v22) = RtlSubAuthoritySid((INT64)Capabilities->Sid, 1ui64),
                    RtlCompareMemory(v22, v21, 28) != (_SIZE_T *)28) )
              {
                v7 = 0;
                v30 = 0;
              }
              v10 = v7;
              if( !v7 )
                break;
              v11 = v25;
            }
            else
            {
              v10 = 1;
            }
LABEL_9:
            ++Capabilities;
          }
          *Matcha = v10;
        }
      }
    }
    else
    {
      *Matcha = 1;
    }
  }
LABEL_11:
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v27 )
    ExFreePoolWithTag(v27, 0);
  return InformationToken;
}

Referenced by: