RtlSidDominatesForTrust
NTSTATUS __stdcall RtlSidDominatesForTrust(VOID *Sid1, VOID *Sid2, UINT8 *pbDominate){
VOID *v3;
__int64 v5;
__int64 v6;
*pbDominate = 0;
v3 = Sid2;
if( Sid1 && !RtlIsValidProcessTrustLabelSid(Sid1) )
return -1073741811;
if( !v3 )
{
LABEL_3:
*pbDominate = 1;
return 0;
}
if( !RtlIsValidProcessTrustLabelSid(v3) )
return -1073741811;
if( v6 )
{
if( *(_DWORD *)(v6 + 8) >= *(_DWORD *)(v5 + 8) && *(_DWORD *)(v6 + 12) >= *(_DWORD *)(v5 + 12) )
goto LABEL_3;
}
else if( !*(_DWORD *)(v5 + 8) )
{
goto LABEL_3;
}
*pbDominate = 0;
return 0;
}Referenced by:
RtlpValidTrustSubjectContext
SeAccessCheckWithHintWithAdminlessChecks
SeAdjustAccessStateForAccessConstraints
SeCreateClientSecurityFromSubjectContext
SeCreateClientSecurityFromSubjectContextEx
SeShouldCheckForAccessRightsFromParent
SeTokenCanImpersonate
SepAdjustAccessStateForConstraints
SepLocateTokenTrustLevel
SepReferenceTokenUsingPseudoHandle
SepTrustLevelCheck