SepReconcileTrustSidWithProcessProtection
VOID __stdcall SepReconcileTrustSidWithProcessProtection(
VOID *TokenTrustSid,
PS_PROTECTION *Protection,
UINT8 *UseNewTrust,
VOID **NewTrustSid){
VOID *v5;
VOID *v6;
_QWORD *v7;
__int64 v8;
__int64 v9;
*UseNewTrust = 0;
*NewTrustSid = 0i64;
v5 = SepSidFromProcessProtection(Protection);
if( v5 && !RtlIsValidProcessTrustLabelSid(v5) )
goto LABEL_12;
if( v6 )
{
if( RtlIsValidProcessTrustLabelSid(v6) )
{
if( v8 )
{
if( *(_DWORD *)(v8 + 8) >= *(_DWORD *)(v9 + 8) && *(_DWORD *)(v8 + 12) >= *(_DWORD *)(v9 + 12) )
return;
}
else if( !*(_DWORD *)(v9 + 8) )
{
return;
}
}
LABEL_12:
*UseNewTrust = 1;
*v7 = v8;
}
}Referenced by:
SeCreateClientSecurity
SeCreateClientSecurityEx