SepFilterCheck

NTSTATUS __stdcall SepFilterCheck(INT64 a1, INT64 *a2, VOID *a3, CHAR a4, INT64 Condition){
  INT64 v5; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v6; 
  int v7; 
  char v8; 
  VOID *v9; 
  unsigned int v10; 
  int v11; 
  __int16 v12; 
  _ACL *v13; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **p_ResourceInfo; 
  _ACL *v15; 
  unsigned int v16; 
  __int64 v18; 
  unsigned __int16 v19; 
  int v20; 
  int v21; 
  _ETHREAD *CurrentThread; 
  _QWORD *v23; 
  VOID *v24; 
  VOID *v25; 
  VOID *v26; 
  int v27; 
  int v28; 
  _QWORD *v29; 
  VOID *pRestrictedDeviceInfo; 
  VOID *pDeviceInfo; 
  VOID *pRestrictedUserInfo; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v33; 
  char v34; 
  UINT64 ConditionSize; 
  int v36; 
  int v37; 
  unsigned int v38; 
  PVOID ResourceInfo; 
  INT64 Result; 
  int v41; 
  VOID *Token; 
  CHAR v43; 

  v43 = a4;
  Token = a3;
  v5 = Condition;
  v6 = 0i64;
  v7 = -1;
  ResourceInfo = 0i64;
  LODWORD(Result) = 0;
  v8 = 0;
  v9 = a3;
  v10 = 0;
  *(_DWORD *)Condition = -1;
  v11 = 0;
  v12 = *(_WORD *)(a1 + 2);
  if( (v12 & 0x10) != 0 )
  {
    if( v12 < 0 )
    {
      v18 = *(unsigned int *)(a1 + 12);
      if( (_DWORD)v18 )
        v13 = (_ACL *)(a1 + v18);
      else
        v13 = 0i64;
    }
    else
    {
      v13 = *(_ACL **)(a1 + 24);
    }
  }
  else
  {
    v13 = 0i64;
  }
  LOBYTE(v41) = 0;
  p_ResourceInfo = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)&ResourceInfo;
  if( a2 )
    p_ResourceInfo = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)a2;
  while( 1 )
  {
    if( !v13 || (v15 = v13 + 1, v16 = 0, !v13->AceCount) )
    {
LABEL_11:
      v15 = 0i64;
      goto LABEL_12;
    }
    while( v16 < v10 || v15->AclRevision != 21 )
    {
      ++v16;
      v15 = (_ACL *)((char *)v15 + v15->AclSize);
      if( v16 >= v13->AceCount )
        goto LABEL_11;
    }
    v10 = v16;
    v38 = v16;
    if( (v15->Sbz1 & 8) != 0 )
      goto LABEL_12;
    v19 = 4 * (v15[1].Sbz1 + 2);
    v20 = v19;
    v21 = v15->AclSize - v19;
    LOWORD(Condition) = v19;
    v36 = v19;
    if( v21 - 8 <= 0 )
      break;
    v37 = *(_DWORD *)&v15->AceCount;
    if( (v37 & 0xFF000000) != 0 )
      break;
    if( a4 && !v8 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquireResourceSharedLite(*((_QWORD *)v9 + 6), 1);
      v9 = Token;
      v6 = 0i64;
      v19 = Condition;
      v8 = 1;
      v10 = v38;
    }
    if( !*p_ResourceInfo )
    {
      v11 = AuthzBasepInitializeResourceClaimsFromSacl(v13, p_ResourceInfo);
      if( v11 < 0 )
        goto LABEL_13;
      v9 = Token;
      v6 = 0i64;
      v19 = Condition;
      v20 = v36;
    }
    v23 = (_QWORD *)*((_QWORD *)v9 + 137);
    LODWORD(Result) = -1;
    if( v23 )
    {
      v24 = (VOID *)v23[75];
      v25 = (VOID *)v23[73];
      v26 = (VOID *)v23[74];
      v6 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v23[72];
    }
    else
    {
      v24 = 0i64;
      v25 = 0i64;
      v26 = 0i64;
    }
    v27 = v15->AclSize - v20;
    Condition = (INT64)&v15[1] + v19;
    LODWORD(ConditionSize) = v27 - 8;
    v11 = AuthzBasepEvaluateAceCondition(
            v9,
            *((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)v9 + 97),
            *p_ResourceInfo,
            v6,
            v26,
            v25,
            v24,
            (UINT8 *)Condition,
            ConditionSize,
            1u,
            0,
            &Result);
    if( v11 < 0 )
      goto LABEL_13;
    if( (_DWORD)Result != 1 )
    {
      v28 = (unsigned __int8)v41;
      if( (v15->Sbz1 & 0x40) != 0 )
        v28 = 1;
      v41 = v28;
      v7 &= v37 | 0x1000000;
    }
    v9 = Token;
    if( (*((_DWORD *)Token + 50) & 0x10) != 0 )
    {
      v29 = (_QWORD *)*((_QWORD *)Token + 137);
      LODWORD(Result) = -1;
      if( v29 )
      {
        pRestrictedDeviceInfo = (VOID *)v29[75];
        pDeviceInfo = (VOID *)v29[73];
        pRestrictedUserInfo = (VOID *)v29[74];
        v33 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v29[72];
      }
      else
      {
        pRestrictedDeviceInfo = 0i64;
        pDeviceInfo = 0i64;
        pRestrictedUserInfo = 0i64;
        v33 = 0i64;
      }
      LODWORD(ConditionSize) = v15->AclSize - v36 - 8;
      v11 = AuthzBasepEvaluateAceCondition(
              Token,
              *((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)Token + 97),
              *p_ResourceInfo,
              v33,
              pRestrictedUserInfo,
              pDeviceInfo,
              pRestrictedDeviceInfo,
              (UINT8 *)Condition,
              ConditionSize,
              1u,
              1u,
              &Result);
      if( v11 < 0 )
        goto LABEL_13;
      a4 = v43;
      v9 = Token;
      if( (_DWORD)Result != 1 )
      {
        v34 = v41;
        if( (v15->Sbz1 & 0x40) != 0 )
          v34 = 1;
        LOBYTE(v41) = v34;
        v7 &= v37 | 0x1000000;
      }
    }
    else
    {
      a4 = v43;
    }
    v6 = 0i64;
LABEL_12:
    ++v10;
    if( !v15 )
      goto LABEL_13;
  }
  v11 = -1073741705;
LABEL_13:
  if( v7 != -1 )
  {
    *(_BYTE *)(v5 + 4) = v41;
    *(_DWORD *)v5 = v7;
  }
  if( v8 )
  {
    ExReleaseResourceLite(*((PERESOURCE *)Token + 6));
    KeLeaveCriticalRegion();
  }
  if( ResourceInfo )
    SepFreeResourceInfo(ResourceInfo);
  return v11;
}

Referenced by: