PspOneDirectionSecurityDomainCombine

NTSTATUS __stdcall PspOneDirectionSecurityDomainCombine(PVOID Object){
  VOID *v2; 
  NTSTATUS result; 
  _EPROCESS *v4; 
  signed __int64 v5; 
  int v6[8]; 
  _GENERIC_MAPPING *GenericMapping; 
  _EPROCESS *Process; 
  VOID *Handle; 
  _SECURITY_SUBJECT_CONTEXT v10[5]; 
  _AUX_ACCESS_DATA AuxData; 

  memset(v10, 0i64, sizeof(v10));
  memset(&AuxData, 0i64, sizeof(AuxData));
  v2 = (VOID *)*((_QWORD *)Object + 168);
  Process = 0i64;
  Handle = 0i64;
  result = PsLookupProcessByProcessId(v2, &Process);
  if( result < 0 )
    goto LABEL_17;
  v4 = Process;
  LOBYTE(result) = PspIsParentProcess((INT64)Process, (INT64)Object);
  if( !(_BYTE)result || (v4->Flags3 & 0x400000) == 0 )
    goto LABEL_12;
  _InterlockedOr(v6, 0);
  if( *((int *)Object + 628) < 0 )
  {
LABEL_17:
    v4 = Process;
    goto LABEL_12;
  }
  v4 = Process;
  if( (Process->MitigationFlags & 0x80000000) == 0 )
  {
    result = SeCreateAccessStateEx(
               0i64,
               &Process->Pcb,
               (_ACCESS_STATE *)v10,
               &AuxData,
               40,
               (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
    if( result >= 0 )
    {
      LOBYTE(GenericMapping) = 0;
      if( ObOpenObjectByPointer(
             Object,
             0x600ui64,
             (PACCESS_STATE)v10,
             0,
             (POBJECT_TYPE)PsProcessType,
             (_KPROCESSOR_MODE)GenericMapping,
             &Handle) >= 0 )
      {
        *((_QWORD *)Object + 317) = v4->SecurityDomain;
        if( ((v4->MitigationFlags | *((_DWORD *)Object + 628)) & 0x80000000) != 0 )
        {
          _InterlockedOr((volatile signed __int32 *)Object + 543, 0x200000u);
          v5 = _InterlockedIncrement64(&PsNextSecurityDomain);
          *((_QWORD *)Object + 316) = v5;
          *((_QWORD *)Object + 317) = v5;
        }
        v4 = Process;
      }
      SepDeleteAccessState((_ACCESS_STATE *)v10);
      result = (unsigned int)SeReleaseSubjectContext(&v10[1]);
    }
  }
LABEL_12:
  if( Handle )
    result = ObCloseHandle(Handle, 0);
  if( v4 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v4);
  return result;
}

Referenced by: