SepAdjustAccessStateForConstraints

NTSTATUS __stdcall SepAdjustAccessStateForConstraints(INT64 a1, VOID *a2, CHAR a3, INT64 a4){
  int v7; 
  int Mask; 
  NTSTATUS result; 
  int v10; 
  int v11; 
  int v12; 
  VOID *v13; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *TrustLabelAce; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *v15; 
  int v16; 
  int v17; 
  int v18; 
  ULONG *p_SidStart; 
  VOID *TokenTrustLevel; 
  int v21; 
  INT64 v22; 
  UINT8 pbDominate; 

  v22 = 0i64;
  pbDominate = 0;
  v7 = -1;
  Mask = -1;
  result = *(_DWORD *)(a4 + 12);
  if( (result & 6) != 0 )
  {
    v10 = *(_DWORD *)(a1 + 68);
    if( v10 == 1 )
    {
      v11 = 17957001;
      v12 = 18809110;
    }
    else if( v10 == 256 )
    {
      v11 = 16908313;
      v12 = 17760262;
    }
    else
    {
      v11 = 0;
      v12 = 0;
    }
    v13 = *(VOID **)(a4 + 32);
    if( !v13 )
      v13 = *(VOID **)(a4 + 48);
    SepFilterCheck((INT64)a2, 0i64, v13, 1, (INT64)&v22);
    if( BYTE4(v22) && a3 )
      v7 = v22;
    TrustLabelAce = SeGetTrustLabelAce(a2);
    v15 = TrustLabelAce;
    if( TrustLabelAce )
    {
      p_SidStart = &TrustLabelAce->SidStart;
      if( TrustLabelAce == (_SYSTEM_PROCESS_TRUST_LABEL_ACE *)-8i64
        || (TokenTrustLevel = SepLocateTokenTrustLevel((_SECURITY_SUBJECT_CONTEXT *)(a4 + 32)),
            RtlSidDominatesForTrust(TokenTrustLevel, p_SidStart, &pbDominate),
            !pbDominate) )
      {
        Mask = v15->Mask;
      }
    }
    v16 = ~(v7 & Mask);
    v17 = v16 & v11;
    v18 = v16 & v12;
    result = -1;
    if( Mask != -1 || v7 != -1 )
    {
      v21 = *(_DWORD *)(a4 + 12);
      result = *(_DWORD *)(a4 + 20);
      if( (v21 & 2) != 0 )
        result &= ~v17;
      if( (v21 & 4) != 0 )
        result &= ~v18;
      *(_DWORD *)(a4 + 20) = result;
    }
  }
  return result;
}

Referenced by: