SepMandatoryIntegrityCheck

NTSTATUS __stdcall SepMandatoryIntegrityCheck(
        _GENERIC_MAPPING *GenericMapping,
        _SECURITY_DESCRIPTOR *SecurityDescriptor,
        UINT8 bNoLabelAce,
        _TOKEN *Token,
        UINT8 bTakeLock,
        _SEP_MANDATORY_INFORMATION *MandatoryInformation){
  unsigned int MandatoryPolicy; 
  char v7; 
  unsigned int v8; 
  signed __int16 Control; 
  _ACL *Sacl; 
  _ACL *v12; 
  unsigned int v13; 
  int v14; 
  _ACL *v15; 
  __int64 IntegrityLevelIndex; 
  _SID_AND_ATTRIBUTES *v17; 
  _WORD *Sid; 
  int Sbz1; 
  int v20; 
  unsigned __int16 v21; 
  unsigned __int16 v22; 
  int v23; 
  int v24; 
  NTSTATUS v25; 
  __int16 v26; 
  bool v27; 
  unsigned int v29; 
  NTSTATUS v30; 
  char v31; 
  char v32; 
  char v33; 
  char v34; 
  NTSTATUS result; 
  __int64 Owner_high; 
  char v37; 
  unsigned int v38; 
  unsigned int GenericRead; 
  unsigned int v40; 
  _ETHREAD *CurrentThread; 
  _ERESOURCE *TokenLock; 
  __int16 v43; 
  unsigned __int8 CurrentIrql; 
  _ETHREAD *v45; 
  UINT8 *OwnerEntryForLegacyShim; 
  unsigned int v47; 
  unsigned int v48; 
  char v49; 
  char v50; 
  __int64 v52; 

  MandatoryPolicy = Token->MandatoryPolicy;
  v7 = 0;
  v8 = 0;
  v49 = 0;
  *(_DWORD *)(v52 + 8) = MandatoryPolicy;
  if( (MandatoryPolicy & 0xFFFFFFFD) != 0 )
  {
    if( bNoLabelAce )
      goto LABEL_47;
    Control = SecurityDescriptor->Control;
    if( (Control & 0x10) == 0 )
      goto LABEL_47;
    if( Control < 0 )
    {
      Owner_high = HIDWORD(SecurityDescriptor->Owner);
      if( !(_DWORD)Owner_high )
        goto LABEL_47;
      Sacl = (_ACL *)(&SecurityDescriptor->Revision + Owner_high);
    }
    else
    {
      Sacl = SecurityDescriptor->Sacl;
    }
    if( Sacl )
    {
      v12 = Sacl + 1;
      v13 = 0;
      if( Sacl->AceCount )
      {
        while( v12->AclRevision != 17 )
        {
          ++v13;
          v12 = (_ACL *)((char *)v12 + v12->AclSize);
          if( v13 >= Sacl->AceCount )
            goto LABEL_47;
        }
        if( (v12->Sbz1 & 8) == 0 )
        {
          v14 = *(_DWORD *)&v12->AceCount;
          v15 = v12 + 1;
          v50 = v14;
LABEL_11:
          if( bTakeLock )
          {
            CurrentThread = (_ETHREAD *)KeGetCurrentThread();
            --CurrentThread->Tcb.KernelApcDisable;
            TokenLock = Token->TokenLock;
            if( (TokenLock->Flag & 0x41) == 1 )
              KeBugCheckEx(0x1C6u, (PVOID)0xF, TokenLock, 0i64, 0i64);
            v43 = TokenLock->Flag & 1;
            if( v43 )
            {
              CurrentIrql = KeGetCurrentIrql();
              v45 = (_ETHREAD *)KeGetCurrentThread();
              if( CurrentIrql > 1u )
                KeBugCheckEx(0x1C6u, 0i64, (PVOID)CurrentIrql, (PVOID)1, 0i64);
              if( (v45->Tcb.ApcState.InProgressFlags & 2) != 0 )
                KeBugCheckEx(0x1C6u, (PVOID)6, 0i64, 0i64, 0i64);
              if( !CurrentIrql && (v45->Tcb._bf_0 & 0x400) == 0 && !v45->Tcb.WaitBlock[3].SpareLong )
                KeBugCheckEx(0x1C6u, (PVOID)7, 0i64, 0i64, 0i64);
            }
            if( v43 )
            {
              OwnerEntryForLegacyShim = ExpAllocateOwnerEntryForLegacyShim();
              if( !(unsigned __int8)ExAcquireFastResourceShared(
                                       (ULONG_PTR)TokenLock,
                                       (ULONG_PTR)OwnerEntryForLegacyShim) )
                ExFreePoolWithTag(OwnerEntryForLegacyShim, 0);
            }
            else
            {
              ExpAcquireResourceSharedLite(Token->TokenLock, 1);
            }
          }
          IntegrityLevelIndex = Token->IntegrityLevelIndex;
          if( (_DWORD)IntegrityLevelIndex == -1 || (v17 = &Token->UserAndGroups[IntegrityLevelIndex]) == 0i64 )
            Sid = SeUntrustedMandatorySid;
          else
            Sid = v17->Sid;
          if( (_BYTE)MandatoryInformation )
            Sid = (_WORD *)SepDefaultMandatorySid;
          if( bTakeLock )
          {
            ExReleaseResourceLite(Token->TokenLock);
            KeLeaveCriticalRegion();
          }
          Sbz1 = v15->Sbz1;
          if( (_BYTE)Sbz1 )
            v20 = *((_DWORD *)&v15[1].AclRevision + (unsigned int)(Sbz1 - 1));
          else
            v20 = 0;
          *(_DWORD *)(v52 + 12) = v20;
          v21 = *(_WORD *)&v15->AclRevision;
          v22 = *Sid;
          if( *(_WORD *)&v15->AclRevision == *Sid
            && !memcmp(v15, Sid, 4 * ((unsigned __int64)*(unsigned __int16 *)&v15->AclRevision >> 8) + 8) )
          {
            goto LABEL_50;
          }
          v23 = *(_DWORD *)(Sid + 1);
          if( !v23 )
            v23 = (unsigned __int16)Sid[3] - 4096;
          if( v23 )
            goto LABEL_92;
          v24 = *(_DWORD *)&v15->AclSize;
          if( !v24 )
            v24 = v15->Sbz2 - 4096;
          if( v24 )
          {
LABEL_92:
            v33 = 0;
            v30 = -1073741811;
            v34 = 0;
LABEL_45:
            result = v30;
            *(_BYTE *)(v52 + 4) = v34;
            *(_DWORD *)v52 = v8;
            *(_BYTE *)(v52 + 5) = v7;
            *(_BYTE *)(v52 + 6) = v33;
            return result;
          }
          LOWORD(v25) = HIBYTE(v22);
          v26 = HIBYTE(v21);
          if( v22 == v21
            && (v25 = memcmp(Sid, v15, 4i64 * HIBYTE(v22) + 8),
                LOBYTE(v26) = HIBYTE(v21),
                v27 = v25 == 0,
                LOBYTE(v25) = HIBYTE(v22),
                v27) )
          {
LABEL_50:
            v30 = 0;
          }
          else
          {
            if( (_BYTE)v25 )
            {
              v29 = *(_DWORD *)&Sid[2 * (unsigned __int8)v25 + 2];
              v30 = 0;
            }
            else
            {
              v30 = 0;
              v29 = 0;
            }
            if( (_BYTE)v26 && v29 < *((_DWORD *)&v15->AceCount + (unsigned int)(unsigned __int8)v26) )
            {
              v31 = 0;
LABEL_38:
              if( (*(_DWORD *)(v52 + 8) & 1) != 0
                && (v7 = 1,
                    v8 = GenericMapping->GenericRead | ~GenericMapping->GenericRead & GenericMapping->GenericExecute | 0x120000,
                    v31) )
              {
                v32 = 1;
                v49 = 1;
                v8 |= GenericMapping->GenericAll | 0x11FFFFF;
              }
              else
              {
                v32 = 0;
              }
              v33 = v7;
              if( v31 )
              {
                v34 = v49;
              }
              else
              {
                v37 = 0;
                if( (v50 & 2) == 0 )
                  v37 = v7;
                if( (v50 & 4) != 0 )
                  v33 = 0;
                v34 = 0;
                if( (v50 & 1) == 0 )
                  v34 = v32;
                if( (v50 & 2) != 0 )
                {
                  v38 = 0;
                  if( v34 )
                    v38 = GenericMapping->GenericWrite | 0x10D0000;
                  GenericRead = GenericMapping->GenericRead;
                  if( v33 )
                    v38 |= ~GenericRead & GenericMapping->GenericExecute | 0x100000;
                  v8 &= v38 | ~(GenericRead | 0x20000);
                }
                if( (v50 & 4) != 0 )
                {
                  v47 = 0;
                  if( v34 )
                    v47 = GenericMapping->GenericWrite | 0x10D0000;
                  v48 = GenericMapping->GenericRead;
                  if( v37 )
                    v47 |= v48 | 0x20000;
                  v8 &= ~(~v47 & (~v48 & GenericMapping->GenericExecute | 0x100000));
                }
                v7 = v37;
                if( (v50 & 1) != 0 )
                {
                  v40 = 0;
                  if( v33 )
                    v40 = ~GenericMapping->GenericRead & GenericMapping->GenericExecute | 0x100000;
                  if( v37 )
                    v40 |= GenericMapping->GenericRead | 0x20000;
                  v8 &= ~(~v40 & (GenericMapping->GenericWrite | 0x10D0000));
                }
              }
              if( (Token->Privileges.Enabled & 0x100000000i64) != 0 )
                v8 |= 0x80000u;
              goto LABEL_45;
            }
          }
          v31 = 1;
          goto LABEL_38;
        }
      }
    }
LABEL_47:
    v15 = (_ACL *)SepDefaultMandatorySid;
    v50 = 1;
    goto LABEL_11;
  }
  *(_DWORD *)v52 = GenericMapping->GenericAll;
  result = 0;
  *(_WORD *)(v52 + 4) = 257;
  *(_BYTE *)(v52 + 6) = 1;
  return result;
}

Referenced by: