RtlCapabilityCheck

NTSTATUS __stdcall RtlCapabilityCheck(VOID *Token, _UNICODE_STRING *CapabilityName, UINT8 *HasCapability){
  char v4; 
  char v5; 
  char v6; 
  int v9; 
  INT64 v10; 
  _DWORD *v11; 
  NTSTATUS v12; 
  _DWORD *v13; 
  NTSTATUS v14; 
  _DWORD *v15; 
  NTSTATUS v16; 
  _DWORD *v17; 
  NTSTATUS v18; 
  NTSTATUS v19; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  INT64 a7; 
  INT64 a8; 
  _DWORD *v26; 
  UINT64 v27; 
  VOID *KeyHandle; 
  UINT64 PerformanceCounter; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  char Sid[16]; 
  char CapabilityGroupSid[48]; 
  char CapabilitySid[48]; 

  WORD2(a8) = 1280;
  LODWORD(v27) = 0;
  KeyHandle = 0i64;
  LODWORD(a8) = 0;
  DestinationString = 0i64;
  v4 = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  LOWORD(a7) = 0;
  v5 = 0;
  v6 = 0;
  *(_DWORD *)((char *)&a7 + 2) = 0;
  KeyValueInformation = 0i64;
  PerformanceCounter = KeQueryPerformanceCounter(0i64);
  if( !CapabilityName || !HasCapability )
  {
    v9 = -1073741811;
    goto LABEL_27;
  }
  *HasCapability = 0;
  v9 = RtlDeriveCapabilitySidsFromName(CapabilityName, CapabilityGroupSid, CapabilitySid);
  if( v9 < 0 )
    goto LABEL_27;
  if( !RtlIsMultiSessionSku()
    || (RtlInitUnicodeString(
          &DestinationString,
          L"\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities"),
        ObjectAttributes.RootDirectory = 0i64,
        ObjectAttributes.ObjectName = &DestinationString,
        ObjectAttributes.Length = 48,
        ObjectAttributes.Attributes = 576,
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64,
        ZwOpenKey(&KeyHandle, 0x80000000ui64, &ObjectAttributes, v10, Length, (INT64)ResultLength, a7, a8) < 0)
    || (LODWORD(Lengtha) = 16,
        ZwQueryValueKey(KeyHandle, CapabilityName, KeyValuePartialInformation, &KeyValueInformation, Lengtha, &v27) < 0) )
  {
    v9 = RtlCheckTokenMembershipEx(Token, CapabilityGroupSid, 2ui64, (UINT8 *)&a7 + 3);
    if( v9 < 0 )
      goto LABEL_27;
    if( !BYTE3(a7) )
    {
      RtlInitializeSid(Sid, (_SID_IDENTIFIER_AUTHORITY *)&a8, 1u);
      LODWORD(v15) = RtlSubAuthoritySid((INT64)Sid, 0i64);
      v26 = v15;
      *v15 = 18;
      v16 = RtlCheckTokenMembership(Token, Sid, (UINT8 *)&a7 + 1);
      v5 = BYTE1(a7);
      v9 = v16;
      if( v16 < 0 )
        goto LABEL_27;
      if( !BYTE1(a7) )
      {
        RtlInitializeSid(Sid, (_SID_IDENTIFIER_AUTHORITY *)&a8, 2u);
        *v26 = 32;
        LODWORD(v17) = RtlSubAuthoritySid((INT64)Sid, 1ui64);
        *v17 = 544;
        v18 = RtlCheckTokenMembership(Token, Sid, (UINT8 *)&a7);
        v4 = a7;
        v9 = v18;
        if( v18 < 0 )
          goto LABEL_27;
        if( !(_BYTE)a7 )
        {
          RtlInitializeSid(Sid, (_SID_IDENTIFIER_AUTHORITY *)&a8, 1u);
          *v26 = 4;
          v19 = RtlCheckTokenMembershipEx(Token, Sid, 2ui64, (UINT8 *)&a7 + 2);
          v6 = BYTE2(a7);
          v9 = v19;
          if( v19 < 0 )
            goto LABEL_27;
          if( !BYTE2(a7) )
            goto LABEL_22;
        }
      }
    }
LABEL_20:
    v9 = RtlCheckTokenCapability(Token, CapabilitySid, (UINT8 *)&a7 + 4);
    if( v9 < 0 )
      goto LABEL_27;
    *HasCapability = BYTE4(a7);
    goto LABEL_22;
  }
  BYTE5(a7) = 1;
  RtlInitializeSid(Sid, (_SID_IDENTIFIER_AUTHORITY *)&a8, 1u);
  LODWORD(v11) = RtlSubAuthoritySid((INT64)Sid, 0i64);
  v26 = v11;
  *v11 = 18;
  v12 = RtlCheckTokenMembership(Token, Sid, (UINT8 *)&a7 + 1);
  v5 = BYTE1(a7);
  v9 = v12;
  if( v12 < 0 )
    goto LABEL_27;
  if( BYTE1(a7) )
    goto LABEL_20;
  RtlInitializeSid(Sid, (_SID_IDENTIFIER_AUTHORITY *)&a8, 2u);
  *v26 = 32;
  LODWORD(v13) = RtlSubAuthoritySid((INT64)Sid, 1ui64);
  *v13 = 544;
  v14 = RtlCheckTokenMembership(Token, Sid, (UINT8 *)&a7);
  v4 = a7;
  v9 = v14;
  if( v14 < 0 )
    goto LABEL_27;
  if( (_BYTE)a7 )
    goto LABEL_20;
LABEL_22:
  if( *HasCapability && !v4 && !v5 )
    v9 = RtlpCapabilityCheckSystemCapability((_HANDLE)Token, CapabilityName);
LABEL_27:
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  v26 = (_DWORD *)KeQueryPerformanceCounter(0i64);
  if( !v5 && !PsIsCurrentThreadInServerSilo() )
    RtlpLogCapabilityCheckLatency(&PerformanceCounter, &v26, v4, v6, SBYTE5(a7), *HasCapability);
  return v9;
}

Referenced by: