SeAdjustAccessStateForAccessConstraints

NTSTATUS __fastcall SeAdjustAccessStateForAccessConstraints(INT64 a1, INT64 a2, INT64 a3){
  int v3; 
  int v4; 
  NTSTATUS result; 
  int Mask; 
  int v9; 
  int v10; 
  VOID *v11; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *TrustLabelAce; 
  _SYSTEM_PROCESS_TRUST_LABEL_ACE *v13; 
  int v14; 
  int v15; 
  ULONG *p_SidStart; 
  VOID *TokenTrustLevel; 
  int v18; 
  UINT8 pbDominate; 
  INT64 v20; 

  v3 = 0;
  pbDominate = 0;
  v20 = 0i64;
  v4 = -1;
  result = *(_DWORD *)(a3 + 12);
  Mask = -1;
  if( (result & 6) != 0 )
  {
    v9 = *(_DWORD *)(a1 + 68);
    if( v9 == 1 )
    {
      v3 = 17957001;
      v10 = 18809110;
    }
    else if( v9 == 256 )
    {
      v3 = 16908313;
      v10 = 17760262;
    }
    else
    {
      v10 = 0;
    }
    v11 = *(VOID **)(a3 + 32);
    if( !v11 )
      v11 = *(VOID **)(a3 + 48);
    SepFilterCheck(a2, 0i64, v11, 1, (INT64)&v20);
    if( BYTE4(v20) )
      v4 = v20;
    TrustLabelAce = SeGetTrustLabelAce((VOID *)a2);
    v13 = TrustLabelAce;
    if( TrustLabelAce )
    {
      p_SidStart = &TrustLabelAce->SidStart;
      if( TrustLabelAce == (_SYSTEM_PROCESS_TRUST_LABEL_ACE *)-8i64
        || (TokenTrustLevel = SepLocateTokenTrustLevel((_SECURITY_SUBJECT_CONTEXT *)(a3 + 32)),
            RtlSidDominatesForTrust(TokenTrustLevel, p_SidStart, &pbDominate),
            !pbDominate) )
      {
        Mask = v13->Mask;
      }
    }
    result = ~(v4 & Mask);
    v14 = result & v3;
    v15 = result & v10;
    if( Mask != -1 || v4 != -1 )
    {
      v18 = *(_DWORD *)(a3 + 12);
      result = *(_DWORD *)(a3 + 20);
      if( (v18 & 2) != 0 )
        result &= ~v14;
      if( (v18 & 4) != 0 )
        result &= ~v15;
      *(_DWORD *)(a3 + 20) = result;
    }
  }
  return result;
}

Referenced by: