SepVariableInitialization
UINT8 __stdcall SepVariableInitialization(){
__int32 bf_84;
bool v1;
unsigned int v2;
VOID **PoolWithTag;
VOID **v4;
_DWORD *v5;
_DWORD *v6;
_DWORD *v7;
_DWORD *v8;
_DWORD *v9;
unsigned int v10;
VOID **v11;
_DWORD *v12;
_DWORD *v13;
_DWORD *v14;
_DWORD *v15;
_DWORD *v16;
_DWORD *v17;
VOID *v18;
_DWORD *v19;
_DWORD *v20;
_DWORD *v21;
_DWORD *v22;
VOID *v23;
_DWORD *v24;
_DWORD *v25;
_DWORD *v26;
__int64 v27;
__int64 v28;
__int64 v29;
__int64 v30;
__int64 v31;
__int64 v32;
_DWORD *v33;
VOID *v34;
VOID *v35;
__int64 v36;
char *v37;
_DWORD *v39;
_DWORD *v40;
__int64 v41;
__int64 v42;
VOID *v43;
__int64 v44;
__int64 v45;
VOID *v46;
VOID *v47;
VOID *v48;
VOID *Sid;
VOID *v50;
VOID *v51;
VOID *v52;
VOID *v53;
VOID *v54;
VOID *v55;
VOID *v56;
VOID *v57;
VOID *v58;
VOID *v59;
VOID *v60;
VOID *v61;
VOID *v62;
VOID *v63;
VOID *v64;
_UNICODE_STRING v65;
_UNICODE_STRING v66;
_UNICODE_STRING v67;
_UNICODE_STRING CapName;
_UNICODE_STRING v69;
_UNICODE_STRING v70;
_UNICODE_STRING v71;
_UNICODE_STRING v72;
_UNICODE_STRING v73;
_UNICODE_STRING v74;
_UNICODE_STRING v75;
_UNICODE_STRING v76;
_UNICODE_STRING v77;
_UNICODE_STRING v78;
_UNICODE_STRING v79;
_UNICODE_STRING v80;
_UNICODE_STRING v81;
_UNICODE_STRING v82;
_UNICODE_STRING v83;
_UNICODE_STRING v84;
VOID *v85;
VOID *v86;
VOID *v87;
VOID *v88;
VOID *CapabilityGroupSid;
VOID *v90;
VOID *v91;
VOID *v92;
VOID *v93;
VOID *v94;
unsigned int v95;
unsigned int NumberOfBytes;
_DWORD *NumberOfBytesa;
unsigned int v98;
_DWORD *v99;
unsigned int v100;
_DWORD *v101;
*(_QWORD *)&CapName.Length = 2359330i64;
CapName.Buffer = L"lpacAppExperience";
v69.Buffer = L"lpacCom";
v70.Buffer = L"lpacCryptoServices";
v71.Buffer = L"lpacIdentityServices";
v72.Buffer = L"lpacInstrumentation";
v73.Buffer = L"lpacEnterprisePolicyChangeNotifications";
v74.Buffer = L"lpacMedia";
v75.Buffer = L"lpacPnpNotifications";
v76.Buffer = L"registryRead";
v77.Buffer = L"lpacServicesManagement";
v78.Buffer = L"lpacSessionManagement";
v79.Buffer = L"lpacPrinting";
v80.Buffer = L"lpacWebPlatform";
v67.Buffer = L"lpacPayments";
v81.Buffer = L"lpacClipboard";
v82.Buffer = L"lpacIME";
v84.Buffer = L"lpacDeviceAccess";
v83.Buffer = L"lpacPackageManagerOperation";
v66.Buffer = L"sessionImpersonation";
v65.Buffer = L"constrainedImpersonation";
LODWORD(v46) = 0;
WORD2(v46) = 0;
LODWORD(v47) = 0;
WORD2(v47) = 256;
LODWORD(v48) = 0;
WORD2(v48) = 512;
LODWORD(v43) = 0;
WORD2(v43) = 768;
LODWORD(v41) = 0;
WORD2(v41) = 1280;
*(_QWORD *)&v69.Length = 1048590i64;
*(_QWORD *)&v70.Length = 2490404i64;
*(_QWORD *)&v71.Length = 2752552i64;
*(_QWORD *)&v72.Length = 2621478i64;
*(_QWORD *)&v73.Length = 5242958i64;
*(_QWORD *)&v74.Length = 1310738i64;
*(_QWORD *)&v75.Length = 2752552i64;
*(_QWORD *)&v76.Length = 1703960i64;
*(_QWORD *)&v77.Length = 3014700i64;
*(_QWORD *)&v78.Length = 2883626i64;
*(_QWORD *)&v79.Length = 1703960i64;
*(_QWORD *)&v80.Length = 2097182i64;
*(_QWORD *)&v67.Length = 1703960i64;
*(_QWORD *)&v81.Length = 1835034i64;
*(_QWORD *)&v82.Length = 1048590i64;
*(_QWORD *)&v84.Length = 2228256i64;
*(_QWORD *)&v83.Length = 3670070i64;
*(_QWORD *)&v66.Length = 2752552i64;
*(_QWORD *)&v65.Length = 3276848i64;
LODWORD(v44) = 0;
WORD2(v44) = 4096;
LODWORD(v45) = 0;
WORD2(v45) = 3840;
LODWORD(v42) = 0;
WORD2(v42) = 4864;
bf_84 = KeLoaderBlock_0->Extension->_bf_84;
v1 = (bf_84 & 0x40) == 0
&& KUSER_SHARED_DATA.NtProductType == NtProductWinNt
&& KUSER_SHARED_DATA.NumberOfPhysicalPages <= 0x83400;
SepTokenSidSharingEnabled = v1;
SepTokenCapabilitySidSharingEnabled = v1;
SepOsLoaderTpmDriverLoaded = (bf_84 & 0x80) != 0;
v2 = RtlLengthRequiredSid(1ui64);
NumberOfBytes = RtlLengthRequiredSid(2ui64);
v95 = RtlLengthRequiredSid(6ui64);
v100 = RtlLengthRequiredSid(9ui64);
v98 = RtlLengthRequiredSid(0xAui64);
SeNullSid = ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
SeCreatorOwnerSid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeCreatorGroupSid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeCreatorOwnerServerSid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeCreatorGroupServerSid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeWorldSid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeLocalSid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
PoolWithTag = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
v4 = PoolWithTag;
SeOwnerRightsSid = PoolWithTag;
v39 = SeNullSid;
if( !SeNullSid )
return 0;
Sid = SeWorldSid;
if( !SeWorldSid )
return 0;
v5 = SeLocalSid;
if( !SeLocalSid )
return 0;
v6 = SeCreatorOwnerSid;
if( !SeCreatorOwnerSid )
return 0;
v7 = SeCreatorGroupSid;
if( !SeCreatorGroupSid )
return 0;
v8 = SeCreatorOwnerServerSid;
if( !SeCreatorOwnerServerSid )
return 0;
if( !PoolWithTag )
return 0;
v9 = SeCreatorGroupServerSid;
if( !SeCreatorGroupServerSid )
return 0;
RtlInitializeSid(SeNullSid, (_SID_IDENTIFIER_AUTHORITY *)&v46, 1u);
RtlInitializeSid(Sid, (_SID_IDENTIFIER_AUTHORITY *)&v47, 1u);
RtlInitializeSid(v5, (_SID_IDENTIFIER_AUTHORITY *)&v48, 1u);
RtlInitializeSid(v6, (_SID_IDENTIFIER_AUTHORITY *)&v43, 1u);
RtlInitializeSid(v7, (_SID_IDENTIFIER_AUTHORITY *)&v43, 1u);
RtlInitializeSid(v8, (_SID_IDENTIFIER_AUTHORITY *)&v43, 1u);
RtlInitializeSid(v9, (_SID_IDENTIFIER_AUTHORITY *)&v43, 1u);
RtlInitializeSid(v4, (_SID_IDENTIFIER_AUTHORITY *)&v43, 1u);
v39[2] = 0;
*((_DWORD *)Sid + 2) = 0;
v5[2] = 0;
v6[2] = 0;
v7[2] = 1;
v8[2] = 2;
v9[2] = 3;
*((_DWORD *)v4 + 2) = 4;
v10 = RtlLengthRequiredSid(0i64);
SeNtAuthoritySid = ExAllocatePoolWithTag(0x11ui64, v10, 1767073107i64);
SeDialupSid = (__int64)ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
SeNetworkSid = (__int64)ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeBatchSid = (__int64)ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeInteractiveSid = (__int64)ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SePrincipalSelfSid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeServiceSid = ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
SeLocalSystemSid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeAuthenticatedUsersSid = (__int64)ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
*(_QWORD *)&SeRestrictedSid = ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
SeAnonymousLogonSid = ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
SeLocalServiceSid = ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
SeNetworkServiceSid = ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
SeIUserSid = ExAllocatePoolWithTag(0x11ui64, v2, 1767073107i64);
SeAliasAdminsSid = ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeAliasUsersSid = ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeAliasGuestsSid = (__int64)ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeAliasPowerUsersSid = (__int64)ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeAliasAccountOpsSid = ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeAliasSystemOpsSid = ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeAliasPrintOpsSid = ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeAliasBackupOpsSid = ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeUntrustedMandatorySid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeLowMandatorySid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeMediumMandatorySid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeHighMandatorySid = ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeSystemMandatorySid = (__int64)ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SePackagePrefixSid = (__int64)ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeCapabilityPrefixSid = (__int64)ExAllocatePoolWithTag(0x210ui64, v2, 1767073107i64);
SeAllAppPackagesSid = ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeAllRestrictedAppPackagesSid = ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeLpacAppExperienceCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacComCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacCryptoServicesCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacIdentityServicesCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacInstrumentationCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacEnterprisePolicyChangeNotificationsCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacMediaCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacPnpNotificationsCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeRegistryReadCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacServicesManagementCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacSessionManagementCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacPrintingCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacWebPlatformCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacPaymentsCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacClipboardCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacImeCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacPackageManagerOperationCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeLpacDeviceAccessCapabilitySid = ExAllocatePool2(288i64, v98, 0x69536553ui64);
SeUserModeDriversSid = ExAllocatePoolWithTag(0x210ui64, v95, 1767073107i64);
SeTrustedInstallerSid = ExAllocatePoolWithTag(0x210ui64, v95, 1767073107i64);
SeProcTrustWinTcbSid = ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeProcTrustWinSid = (__int64)ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeProcTrustAuthenticodeSid = (__int64)ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeProcTrustLiteAntimalwareSid = (__int64)ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeProcTrustLiteWinTcbSid = (__int64)ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeProcTrustLiteWinSid = (__int64)ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeProcTrustLiteAppSid = (__int64)ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeProcTrustNoneSid = (__int64)ExAllocatePoolWithTag(0x210ui64, NumberOfBytes, 1767073107i64);
SeDefaultAccountAliasSid = ExAllocatePoolWithTag(0x11ui64, NumberOfBytes, 1767073107i64);
SeConstrainedImpersonationCapabilityGroupSid = ExAllocatePoolWithTag(0x11ui64, v100, 1767073107i64);
SeConstrainedImpersonationCapabilitySid = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeSessionImpersonationCapabilityGroupSid = ExAllocatePoolWithTag(0x11ui64, v100, 1767073107i64);
v11 = ExAllocatePoolWithTag(0x11ui64, v98, 1767073107i64);
SeSessionImpersonationCapabilitySid = v11;
if( !SeNtAuthoritySid )
return 0;
NumberOfBytesa = (_DWORD *)SeDialupSid;
if( !SeDialupSid )
return 0;
v99 = (_DWORD *)SeNetworkSid;
if( !SeNetworkSid )
return 0;
v101 = (_DWORD *)SeBatchSid;
if( !SeBatchSid )
return 0;
Sid = (VOID *)SeInteractiveSid;
if( !SeInteractiveSid )
return 0;
v58 = SeServiceSid;
if( !SeServiceSid )
return 0;
v57 = SePrincipalSelfSid;
if( !SePrincipalSelfSid )
return 0;
v56 = SeLocalSystemSid;
if( !SeLocalSystemSid )
return 0;
v55 = (VOID *)SeAuthenticatedUsersSid;
if( !SeAuthenticatedUsersSid )
return 0;
v54 = *(VOID **)&SeRestrictedSid;
if( !*(_QWORD *)&SeRestrictedSid )
return 0;
v53 = SeAnonymousLogonSid;
if( !SeAnonymousLogonSid )
return 0;
v52 = SeLocalServiceSid;
if( !SeLocalServiceSid )
return 0;
v51 = SeNetworkServiceSid;
if( !SeNetworkServiceSid )
return 0;
v50 = SeIUserSid;
if( !SeIUserSid )
return 0;
v48 = SeAliasAdminsSid;
if( !SeAliasAdminsSid )
return 0;
v47 = SeAliasUsersSid;
if( !SeAliasUsersSid )
return 0;
v46 = (VOID *)SeAliasGuestsSid;
if( !SeAliasGuestsSid )
return 0;
v43 = (VOID *)SeAliasPowerUsersSid;
if( !SeAliasPowerUsersSid )
return 0;
v12 = SeAliasAccountOpsSid;
if( !SeAliasAccountOpsSid )
return 0;
v13 = SeAliasSystemOpsSid;
if( !SeAliasSystemOpsSid )
return 0;
v14 = SeAliasPrintOpsSid;
if( !SeAliasPrintOpsSid )
return 0;
v15 = SeAliasBackupOpsSid;
if( !SeAliasBackupOpsSid )
return 0;
v59 = SeUntrustedMandatorySid;
if( !SeUntrustedMandatorySid )
return 0;
v60 = SeLowMandatorySid;
if( !SeLowMandatorySid )
return 0;
v61 = SeMediumMandatorySid;
if( !SeMediumMandatorySid )
return 0;
v62 = SeHighMandatorySid;
if( !SeHighMandatorySid )
return 0;
v63 = (VOID *)SeSystemMandatorySid;
if( !SeSystemMandatorySid )
return 0;
v64 = (VOID *)SePackagePrefixSid;
if( !SePackagePrefixSid )
return 0;
v40 = (_DWORD *)SeCapabilityPrefixSid;
if( !SeCapabilityPrefixSid )
return 0;
v16 = SeAllAppPackagesSid;
if( !SeAllAppPackagesSid )
return 0;
v17 = SeAllRestrictedAppPackagesSid;
if( !SeAllRestrictedAppPackagesSid )
return 0;
if( !SeLpacAppExperienceCapabilitySid )
return 0;
if( !SeLpacComCapabilitySid )
return 0;
if( !SeLpacCryptoServicesCapabilitySid )
return 0;
if( !SeLpacIdentityServicesCapabilitySid )
return 0;
if( !SeLpacInstrumentationCapabilitySid )
return 0;
if( !SeLpacEnterprisePolicyChangeNotificationsCapabilitySid )
return 0;
if( !SeLpacMediaCapabilitySid )
return 0;
if( !SeLpacPnpNotificationsCapabilitySid )
return 0;
if( !SeRegistryReadCapabilitySid )
return 0;
if( !SeLpacServicesManagementCapabilitySid )
return 0;
if( !SeLpacSessionManagementCapabilitySid )
return 0;
if( !SeLpacPrintingCapabilitySid )
return 0;
if( !SeLpacWebPlatformCapabilitySid )
return 0;
if( !SeLpacPaymentsCapabilitySid )
return 0;
if( !SeLpacClipboardCapabilitySid )
return 0;
if( !SeLpacImeCapabilitySid )
return 0;
if( !SeLpacPackageManagerOperationCapabilitySid )
return 0;
if( !SeLpacDeviceAccessCapabilitySid )
return 0;
v18 = SeUserModeDriversSid;
if( !SeUserModeDriversSid )
return 0;
v88 = SeProcTrustWinTcbSid;
if( !SeProcTrustWinTcbSid )
return 0;
v90 = (VOID *)SeProcTrustWinSid;
if( !SeProcTrustWinSid )
return 0;
v91 = (VOID *)SeProcTrustAuthenticodeSid;
if( !SeProcTrustAuthenticodeSid )
return 0;
v92 = (VOID *)SeProcTrustLiteAntimalwareSid;
if( !SeProcTrustLiteAntimalwareSid )
return 0;
v93 = (VOID *)SeProcTrustLiteWinTcbSid;
if( !SeProcTrustLiteWinTcbSid )
return 0;
v94 = (VOID *)SeProcTrustLiteWinSid;
if( !SeProcTrustLiteWinSid )
return 0;
v87 = (VOID *)SeProcTrustLiteAppSid;
if( !SeProcTrustLiteAppSid )
return 0;
v86 = (VOID *)SeProcTrustNoneSid;
if( !SeProcTrustNoneSid )
return 0;
v85 = SeTrustedInstallerSid;
if( !SeTrustedInstallerSid )
return 0;
if( !SeDefaultAccountAliasSid )
return 0;
if( !SeConstrainedImpersonationCapabilitySid )
return 0;
CapabilityGroupSid = SeConstrainedImpersonationCapabilityGroupSid;
if( !SeConstrainedImpersonationCapabilityGroupSid )
return 0;
if( !v11 )
return 0;
if( !SeSessionImpersonationCapabilityGroupSid )
return 0;
RtlInitializeSid(SeNtAuthoritySid, (_SID_IDENTIFIER_AUTHORITY *)&v41, 0);
RtlInitializeSid(NumberOfBytesa, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v99, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v101, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(Sid, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v58, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v57, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v56, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v55, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v54, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v53, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v52, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v51, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v50, (_SID_IDENTIFIER_AUTHORITY *)&v41, 1u);
RtlInitializeSid(v48, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
RtlInitializeSid(v47, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
RtlInitializeSid(v46, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
RtlInitializeSid(v43, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
RtlInitializeSid(v12, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
RtlInitializeSid(v13, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
RtlInitializeSid(v14, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
RtlInitializeSid(v15, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
RtlInitializeSid(v85, (_SID_IDENTIFIER_AUTHORITY *)&v41, 6u);
RtlInitializeSid(v59, (_SID_IDENTIFIER_AUTHORITY *)&v44, 1u);
RtlInitializeSid(v60, (_SID_IDENTIFIER_AUTHORITY *)&v44, 1u);
RtlInitializeSid(v61, (_SID_IDENTIFIER_AUTHORITY *)&v44, 1u);
RtlInitializeSid(v62, (_SID_IDENTIFIER_AUTHORITY *)&v44, 1u);
RtlInitializeSid(v63, (_SID_IDENTIFIER_AUTHORITY *)&v44, 1u);
RtlInitializeSid(v64, (_SID_IDENTIFIER_AUTHORITY *)&v45, 1u);
RtlInitializeSid(v40, (_SID_IDENTIFIER_AUTHORITY *)&v45, 1u);
RtlInitializeSid(v16, (_SID_IDENTIFIER_AUTHORITY *)&v45, 2u);
RtlInitializeSid(v17, (_SID_IDENTIFIER_AUTHORITY *)&v45, 2u);
memset(v18, 0i64, v95);
RtlInitializeSid(v18, (_SID_IDENTIFIER_AUTHORITY *)&v41, 6u);
RtlInitializeSid(v86, (_SID_IDENTIFIER_AUTHORITY *)&v42, 2u);
RtlInitializeSid(v88, (_SID_IDENTIFIER_AUTHORITY *)&v42, 2u);
RtlInitializeSid(v90, (_SID_IDENTIFIER_AUTHORITY *)&v42, 2u);
RtlInitializeSid(v91, (_SID_IDENTIFIER_AUTHORITY *)&v42, 2u);
RtlInitializeSid(v92, (_SID_IDENTIFIER_AUTHORITY *)&v42, 2u);
RtlInitializeSid(v93, (_SID_IDENTIFIER_AUTHORITY *)&v42, 2u);
RtlInitializeSid(v94, (_SID_IDENTIFIER_AUTHORITY *)&v42, 2u);
RtlInitializeSid(v87, (_SID_IDENTIFIER_AUTHORITY *)&v42, 2u);
v19 = v48;
v20 = v47;
v21 = v46;
NumberOfBytesa[2] = 1;
v99[2] = 2;
v101[2] = 3;
*((_DWORD *)Sid + 2) = 4;
*((_DWORD *)v58 + 2) = 6;
*((_DWORD *)v57 + 2) = 10;
*((_DWORD *)v56 + 2) = 18;
*((_DWORD *)v55 + 2) = 11;
*((_DWORD *)v54 + 2) = 12;
*((_DWORD *)v53 + 2) = 7;
*((_DWORD *)v52 + 2) = 19;
*((_DWORD *)v51 + 2) = 20;
*((_DWORD *)v50 + 2) = 17;
v22 = v43;
v19[2] = 32;
v20[2] = 32;
v21[2] = 32;
v22[2] = 32;
v12[2] = 32;
v13[2] = 32;
v14[2] = 32;
v15[2] = 32;
v19[3] = 544;
v20[3] = 545;
v23 = CapabilityGroupSid;
v21[3] = 546;
v22[3] = 547;
v24 = v59;
v12[3] = 548;
v13[3] = 549;
v14[3] = 550;
v15[3] = 551;
v24[2] = 0;
*((_DWORD *)v60 + 2) = 4096;
*((_DWORD *)v61 + 2) = 0x2000;
*((_DWORD *)v62 + 2) = 12288;
*((_DWORD *)v63 + 2) = 0x4000;
*((_DWORD *)v64 + 2) = 2;
v40[2] = 3;
v16[2] = 2;
v16[3] = 1;
v17[2] = 2;
v17[3] = 2;
if( RtlDeriveCapabilitySidsFromName(&CapName, v23, SeLpacAppExperienceCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(&v69, SeConstrainedImpersonationCapabilityGroupSid, SeLpacComCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v70,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacCryptoServicesCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v71,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacIdentityServicesCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v72,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacInstrumentationCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v73,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacEnterprisePolicyChangeNotificationsCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(&v74, SeConstrainedImpersonationCapabilityGroupSid, SeLpacMediaCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v75,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacPnpNotificationsCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(&v76, SeConstrainedImpersonationCapabilityGroupSid, SeRegistryReadCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v77,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacServicesManagementCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v78,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacSessionManagementCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(&v79, SeConstrainedImpersonationCapabilityGroupSid, SeLpacPrintingCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v80,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacWebPlatformCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(&v67, SeConstrainedImpersonationCapabilityGroupSid, SeLpacPaymentsCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(&v81, SeConstrainedImpersonationCapabilityGroupSid, SeLpacClipboardCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(&v82, SeConstrainedImpersonationCapabilityGroupSid, SeLpacImeCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v83,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacPackageManagerOperationCapabilitySid) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v84,
SeConstrainedImpersonationCapabilityGroupSid,
SeLpacDeviceAccessCapabilitySid) < 0 )
return 0;
v25 = SeDefaultAccountAliasSid;
*((_DWORD *)SeUserModeDriversSid + 2) = 84;
*(_QWORD *)(SeProcTrustNoneSid + 8) = 0i64;
v26 = SeProcTrustWinTcbSid;
*((_DWORD *)SeProcTrustWinTcbSid + 2) = 1024;
v26[3] = 0x2000;
v27 = SeProcTrustWinSid;
*(_DWORD *)(SeProcTrustWinSid + 8) = 1024;
*(_DWORD *)(v27 + 12) = 4096;
v28 = SeProcTrustAuthenticodeSid;
*(_DWORD *)(SeProcTrustAuthenticodeSid + 8) = 1024;
*(_DWORD *)(v28 + 12) = 1024;
v29 = SeProcTrustLiteAntimalwareSid;
*(_DWORD *)(SeProcTrustLiteAntimalwareSid + 8) = 512;
*(_DWORD *)(v29 + 12) = 1536;
v30 = SeProcTrustLiteWinTcbSid;
*(_DWORD *)(SeProcTrustLiteWinTcbSid + 8) = 512;
*(_DWORD *)(v30 + 12) = 0x2000;
v31 = SeProcTrustLiteWinSid;
*(_DWORD *)(SeProcTrustLiteWinSid + 8) = 512;
*(_DWORD *)(v31 + 12) = 4096;
v32 = SeProcTrustLiteAppSid;
*(_DWORD *)(SeProcTrustLiteAppSid + 8) = 512;
*(_DWORD *)(v32 + 12) = 2048;
v33 = SeTrustedInstallerSid;
*((_DWORD *)SeTrustedInstallerSid + 2) = 80;
v33[3] = 956008885;
v33[4] = -876444647;
v33[5] = 1831038044;
v33[6] = 1853292631;
v33[7] = -2023488832;
RtlInitializeSid(v25, (_SID_IDENTIFIER_AUTHORITY *)&v41, 2u);
v34 = SeConstrainedImpersonationCapabilitySid;
v35 = SeConstrainedImpersonationCapabilityGroupSid;
v25[2] = 32;
v25[3] = 581;
if( RtlDeriveCapabilitySidsFromName(&v65, v35, v34) < 0 )
return 0;
if( RtlDeriveCapabilitySidsFromName(
&v66,
SeSessionImpersonationCapabilityGroupSid,
SeSessionImpersonationCapabilitySid) < 0 )
return 0;
SepInitSystemDacls();
SeCreateTokenPrivilege = (_LUID)2i64;
SeAssignPrimaryTokenPrivilege = (_LUID)3i64;
SeLockMemoryPrivilege = (_LUID)4i64;
SeIncreaseQuotaPrivilege = (_LUID)5i64;
v48 = (VOID *)6;
SeUnsolicitedInputPrivilege = 6i64;
v47 = (VOID *)7;
SeTcbPrivilege = (_LUID)7i64;
v46 = (VOID *)8;
SeSecurityPrivilege = (_LUID)8i64;
v45 = 9i64;
SeTakeOwnershipPrivilege = 9i64;
v44 = 10i64;
SeLoadDriverPrivilege = (_LUID)10i64;
v43 = (VOID *)15;
SeCreatePagefilePrivilege = (_LUID)15i64;
v42 = 14i64;
SeIncreaseBasePriorityPrivilege = (_LUID)14i64;
v41 = 11i64;
SeSystemProfilePrivilege = (_LUID)11i64;
v50 = (VOID *)12;
SeSystemtimePrivilege = (_LUID)12i64;
v51 = (VOID *)13;
SeProfileSingleProcessPrivilege = (_LUID)13i64;
v52 = (VOID *)16;
SeCreatePermanentPrivilege = (_LUID)16i64;
v53 = (VOID *)17;
SeBackupPrivilege = (_LUID)17i64;
v54 = (VOID *)18;
SeRestorePrivilege = (_LUID)18i64;
v55 = (VOID *)19;
SeShutdownPrivilege = (_LUID)19i64;
v56 = (VOID *)20;
SeDebugPrivilege = (_LUID)20i64;
v57 = (VOID *)21;
SeAuditPrivilege = 21i64;
v58 = (VOID *)22;
Sid = (VOID *)23;
SeSystemEnvironmentPrivilege = (_LUID)22i64;
SeChangeNotifyPrivilege = 23i64;
SeRemoteShutdownPrivilege = 24i64;
SeUndockPrivilege = 25i64;
SeSyncAgentPrivilege = 26i64;
SeEnableDelegationPrivilege = 27i64;
qword_140D2DD28 = (__int64)SeNullSid;
qword_140D2DD30 = (__int64)SeWorldSid;
qword_140D2DD38 = (__int64)SeLocalSid;
qword_140D2DD40 = (__int64)SeCreatorOwnerSid;
qword_140D2DD48 = (__int64)SeCreatorGroupSid;
qword_140D2DE70 = (__int64)SeOwnerRightsSid;
qword_140D2DD50 = (__int64)SeNtAuthoritySid;
qword_140D2DD58 = SeDialupSid;
qword_140D2DD60 = SeNetworkSid;
qword_140D2DD68 = SeBatchSid;
qword_140D2DD70 = SeInteractiveSid;
qword_140D2DD78 = (__int64)SeLocalSystemSid;
qword_140D2DDC0 = SeAuthenticatedUsersSid;
qword_140D2DDC8 = *(_QWORD *)&SeRestrictedSid;
qword_140D2DDD0 = (__int64)SeAnonymousLogonSid;
qword_140D2DDF0 = (__int64)SeLocalServiceSid;
qword_140D2DDF8 = (__int64)SeNetworkServiceSid;
qword_140D2DE40 = (__int64)SeIUserSid;
qword_140D2DD80 = (__int64)SeAliasAdminsSid;
qword_140D2DD88 = (__int64)SeAliasUsersSid;
qword_140D2DD90 = SeAliasGuestsSid;
qword_140D2DD98 = SeAliasPowerUsersSid;
qword_140D2DDA0 = (__int64)SeAliasAccountOpsSid;
qword_140D2DDA8 = (__int64)SeAliasSystemOpsSid;
qword_140D2DDB0 = (__int64)SeAliasPrintOpsSid;
qword_140D2DDB8 = (__int64)SeAliasBackupOpsSid;
qword_140D2DE48 = (__int64)SeUntrustedMandatorySid;
qword_140D2DE50 = (__int64)SeLowMandatorySid;
SeManageVolumePrivilege = 28i64;
SeImpersonatePrivilege = 29i64;
SeCreateGlobalPrivilege = (_LUID)30i64;
SeTrustedCredManAccessPrivilege = 31i64;
SeRelabelPrivilege = 32i64;
SeIncreaseWorkingSetPrivilege = 33i64;
SeTimeZonePrivilege = (_LUID)34i64;
SeCreateSymbolicLinkPrivilege = 35i64;
SeDelegateSessionUserImpersonatePrivilege = 36i64;
qword_140D2DE58 = (__int64)SeMediumMandatorySid;
qword_140D2DE60 = (__int64)SeHighMandatorySid;
qword_140D2DE68 = SeSystemMandatorySid;
qword_140D2DE78 = (__int64)SeAllAppPackagesSid;
qword_140D2DE80 = (__int64)SeUserModeDriversSid;
qword_140D2DE88 = (__int64)SeProcTrustWinTcbSid;
qword_140D2DE90 = (__int64)SeTrustedInstallerSid;
SepExports = 2i64;
qword_140D2DC78 = 3i64;
qword_140D2DC80 = 4i64;
qword_140D2DC88 = 5i64;
qword_140D2DC90 = 6i64;
qword_140D2DC98 = 7i64;
qword_140D2DCA0 = 8i64;
qword_140D2DCA8 = 9i64;
qword_140D2DCB0 = 10i64;
qword_140D2DCB8 = 15i64;
qword_140D2DCC0 = 14i64;
qword_140D2DCC8 = 11i64;
qword_140D2DCD0 = 12i64;
qword_140D2DCD8 = 13i64;
qword_140D2DCE0 = 16i64;
qword_140D2DCE8 = 17i64;
qword_140D2DCF0 = 18i64;
qword_140D2DCF8 = 19i64;
qword_140D2DD00 = 20i64;
qword_140D2DD08 = 21i64;
qword_140D2DD10 = 22i64;
qword_140D2DE98 = 36i64;
qword_140D2DE08 = 29i64;
qword_140D2DE30 = 34i64;
v36 = 5i64;
qword_140D2DE38 = 35i64;
v37 = (char *)&unk_140C25C98;
qword_140D2DD18 = 23i64;
qword_140D2DD20 = 24i64;
qword_140D2DDD8 = 25i64;
qword_140D2DDE0 = 26i64;
qword_140D2DDE8 = 27i64;
qword_140D2DE00 = 28i64;
qword_140D2DE10 = 30i64;
qword_140D2DE18 = 31i64;
qword_140D2DE20 = 32i64;
qword_140D2DE28 = 33i64;
SeExports = (PSE_EXPORTS)&SepExports;
do
{
v37[8] = 0;
*(_QWORD *)v37 = 0i64;
*((_QWORD *)v37 - 3) = 0i64;
v37 += 40;
--v36;
}
while( v36 );
stru_140C25D50._bf_0 = 0i64;
qword_140C25D48 = 0i64;
return SepInitializeSharedSidMap() >= 0;
}Referenced by:
SepInitializationPhase0