SepCommonAccessCheckExWithAdminlessChecks
INT8 __fastcall SepCommonAccessCheckExWithAdminlessChecks(
_SECURITY_SUBJECT_CONTEXT *SubjectContext,
INT8 dl0,
INT64 a3,
INT64 a4,
INT64 a5,
INT64 a6,
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **a7,
_SEP_MANDATORY_INFORMATION *MandatoryInformation){
_SECURITY_SUBJECT_CONTEXT *v10;
_DWORD *v12;
_DWORD *v13;
_DWORD *v14;
_QWORD *v15;
INT8 v16;
_ACCESS_REASONS *v17;
unsigned int v18;
_SECURITY_DESCRIPTOR *v19;
char v20;
__int64 v21;
int v22;
NTSTATUS v23;
_IOBJECT_TYPE_LIST *ReturnSomeAccessDenied;
int *v25;
unsigned int ConstraintMask;
int *v27;
_TOKEN *ClientToken;
__int64 v29;
NTSTATUS v30;
int *v31;
unsigned int v32;
__int64 v33;
int v34;
char v35;
NTSTATUS *v36;
UINT8 v37;
NTSTATUS v38;
char v39;
UINT8 IsOwner;
unsigned int v41;
unsigned int v42;
char v43;
UINT8 v44;
__int64 v45;
_TOKEN *v46;
_TOKEN *PrimaryToken;
UINT8 v48;
_RTL_DYNAMIC_HASH_TABLE_ENTRY *v49;
UINT64 v50;
UINT64 *v51;
int v52;
unsigned int *v53;
_DWORD *v54;
unsigned int v55;
UINT8 v56;
unsigned int *v57;
_DWORD *v58;
int v59;
unsigned int v60;
UINT8 v61;
_DWORD *v62;
unsigned int UserGroupsRemaining;
UINT8 v65;
__int64 v66;
__int16 v67;
__int64 v68;
_ACL *v69;
UINT8 v70;
UINT64 v71;
int v72;
int v73;
int v74;
unsigned int v75;
int v76;
int *v77;
int v78;
_QWORD *v79;
bool v80;
__int64 v81;
VOID *TokenTrustLevel;
unsigned int v83;
UINT64 v84;
UINT64 v85;
_SEP_LOGON_SESSION_REFERENCES *LogonSession;
int v87;
__int64 v88;
__int16 v89;
__int64 v90;
_ACL *v91;
VOID *ScopedPolicySid;
NTSTATUS Cap;
_RTL_DYNAMIC_HASH_TABLE_ENTRY *v94;
bool v95;
unsigned int *v96;
VOID **v97;
int v98;
unsigned int v99;
unsigned int **v100;
unsigned int *v101;
unsigned int v102;
_DWORD *v103;
__int64 v104;
UINT8 v105;
VOID **PoolWithTag;
_SEP_CENTRALIZED_ACCESS_POLICIES_TABLE *v107;
unsigned int Blink_high;
unsigned int v109;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v110;
NTSTATUS v111;
int v112;
_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION *pClaimAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v114;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v115;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v116;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v117;
NTSTATUS v118;
int v119;
NTSTATUS v120;
_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION *v121;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pRestrictedDeviceSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pDeviceSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pRestrictedUserSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pUserSecurityAttributes;
int v126;
int v127;
_TOKEN *v128;
_TOKEN *v129;
UINT8 v130;
int v131;
int v132;
int v133;
int v134;
unsigned int v135;
void *v136;
int v137;
int v138;
_TOKEN *v139;
_TOKEN *v140;
__int64 v141;
int v142;
int v143;
__int64 v144;
int v145;
int v146;
unsigned int v147;
VOID **v148;
int v149;
UINT64 v150;
int v151;
unsigned int v152;
unsigned int v153;
UINT8 v154;
_LIST_ENTRY *v155;
_LIST_ENTRY *v156;
_LIST_ENTRY *v157;
_DWORD *v158;
_ACCESS_REASONS *v159;
unsigned int v160;
unsigned int v161;
__int64 v162;
VOID *v163;
_LIST_ENTRY *Blink;
UINT64 OverWrite;
UINT64 OverWritea;
UINT8 OverWriteb;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfo;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfoa;
_SEP_TRUST_CHECK_INFORMATION *TrustCheckInfob;
_GENERIC_MAPPING *GenericMapping;
_GENERIC_MAPPING *GenericMappinga;
_GENERIC_MAPPING *PreviouslyGrantedAccess;
_GENERIC_MAPPING *PreviouslyGrantedAccessa;
_GENERIC_MAPPING *PreviouslyGrantedAccessb;
UINT64 PreviousMode;
UINT64 PreviousModea;
_PRIVILEGE_SET **Privileges;
PRIVILEGE_SET **AccessStatus;
_ACCESS_REASONS *AccessReason;
_ACCESS_REASONS *TokenIsOwner;
UINT8 PackageCapabilityInfo;
char v183;
UINT8 v185;
UINT8 v186[8];
unsigned int v187;
UINT64 Data;
INT64 v189;
unsigned int v190;
int v191;
UINT64 v192;
int v193;
_RTL_DYNAMIC_HASH_TABLE_ENTRY *a2;
INT64 Result;
_SEP_TRUST_CHECK_INFORMATION v196;
__int64 v197;
unsigned int v198;
char v199[12];
VOID *InputToken;
_ACCESS_REASONS CapeSecurityDescriptor;
_SE_PACKAGE_CAPABILITY_INFO v202;
_IOBJECT_TYPE_LIST *v203;
UINT64 ObjectTypeListLength[2];
__int128 v205;
__int128 v206;
_ACCESS_REASONS Reasons;
_ACCESS_REASONS SourceReasons;
_ACCESS_REASONS v209;
*(_QWORD *)&CapeSecurityDescriptor.Data[10] = SubjectContext;
v185 = 0;
v186[6] = 0;
v203 = 0i64;
v10 = SubjectContext;
memset(v199, 0, sizeof(v199));
CapeSecurityDescriptor.Data[1] = 0;
a2 = 0i64;
v183 = 0;
*(_OWORD *)&CapeSecurityDescriptor.Data[4] = 0i64;
v189 = 0i64;
*(_OWORD *)&v202.PackageGrantedAccess = 0i64;
LODWORD(Result) = 0;
memset(&CapeSecurityDescriptor.Data[12], 0, 80);
memset(&Reasons, 0i64, sizeof(Reasons));
memset(&SourceReasons, 0i64, sizeof(SourceReasons));
memset(&v209, 0i64, sizeof(v209));
v186[2] = 0;
v196.ConstraintMask = -1;
CapeSecurityDescriptor.Data[2] = -1;
if( !a4 )
return 0;
if( *(_DWORD *)a4 != 40 )
return 0;
v12 = *(_DWORD **)(a4 + 16);
if( !v12 )
return 0;
if( !v10
|| !a3
|| *(_DWORD *)a3 != 56
|| (v13 = *(_DWORD **)(a4 + 8)) == 0i64
|| (v14 = *(_DWORD **)(a3 + 8)) != 0i64 && (*v14 != 16 || (v14[1] & 0xFFFFFFF8) != 0)
|| a5 && *(_DWORD *)a5 != 96 )
{
*v12 = -1073741811;
return 0;
}
*v13 = 0;
**(_DWORD **)(a4 + 16) = -1073741790;
v15 = *(_QWORD **)(a4 + 32);
LODWORD(v192) = 0;
CapeSecurityDescriptor.Data[0] = -1073741790;
if( v15 )
*v15 = 0i64;
v16 = 1;
v17 = *(_ACCESS_REASONS **)(a4 + 24);
v198 = *(_DWORD *)(a3 + 16) & ~*(_DWORD *)(a3 + 20) & 0xFDFFFFFF;
v18 = v198;
AuthzBasepSetAccessReasons(v198, 0i64, 0i64, v17, 1u);
if( (_BYTE)a6 == v20 )
{
v76 = *(_DWORD *)(a3 + 16);
v77 = *(int **)(a4 + 8);
if( (v76 & 0x2000000) != 0 )
{
*v77 = *(_DWORD *)(*(_QWORD *)(a3 + 32) + 12i64);
**(_DWORD **)(a4 + 8) |= *(_DWORD *)(a3 + 16) & 0xFDFFFFFF;
**(_DWORD **)(a4 + 8) |= *(_DWORD *)(a3 + 20);
}
else
{
*v77 = *(_DWORD *)(a3 + 20) | v76;
}
**(_DWORD **)(a4 + 16) = 0;
return v16;
}
v21 = *(_QWORD *)(a3 + 8);
if( !v21 || !*(_QWORD *)(v21 + 8) )
{
**(_DWORD **)(a4 + 16) = -1073741790;
return 0;
}
if( v10->ClientToken && v10->ImpersonationLevel < SecurityImpersonation )
{
**(_DWORD **)(a4 + 16) = -1073741659;
return 0;
}
if( !*(_DWORD *)(a3 + 16) )
{
v78 = *(_DWORD *)(a3 + 20);
if( !v78 )
{
**(_DWORD **)(a4 + 16) = -1073741790;
return 0;
}
**(_DWORD **)(a4 + 8) = v78;
**(_DWORD **)(a4 + 16) = 0;
v79 = *(_QWORD **)(a4 + 32);
if( v79 )
*v79 = 0i64;
return v16;
}
v22 = *(_DWORD *)(a4 + 4);
if( v22 != 1 && v22 != *(_DWORD *)(a3 + 40) )
{
**(_DWORD **)(a4 + 16) = -1073741811;
return 0;
}
if( !dl0 )
{
SeLockSubjectContext(v10);
v21 = *(_QWORD *)(a3 + 8);
}
LOBYTE(TrustCheckInfo) = 0;
v23 = SepTrustLevelCheck(v19, *(VOID **)(v21 + 8), (_TOKEN *)v10, 0i64, 0i64, TrustCheckInfo, &v196);
ReturnSomeAccessDenied = 0i64;
**(_DWORD **)(a4 + 16) = v23;
v25 = *(int **)(a4 + 16);
if( *v25 < 0 )
{
v80 = dl0 == 0;
goto LABEL_121;
}
ConstraintMask = v196.ConstraintMask;
*v25 = (*(_DWORD *)(a3 + 16) & 0xFDFFFFFF) != (v196.ConstraintMask & *(_DWORD *)(a3 + 16) & 0xFDFFFFFF) ? 0xC0000022 : 0;
v27 = *(int **)(a4 + 16);
ClientToken = (_TOKEN *)v10->ClientToken;
InputToken = v10->ClientToken;
if( *v27 < 0 )
{
if( !ClientToken )
InputToken = v10->PrimaryToken;
v81 = *(_QWORD *)(a3 + 8);
TokenTrustLevel = SepLocateTokenTrustLevel(v10);
SeLogAccessFailure(InputToken, 0i64, 0i64, (UINT64)TokenTrustLevel, *(_QWORD *)(v81 + 8));
if( !dl0 )
SeUnlockSubjectContext(v10);
OverWriteb = 0;
v83 = v198 & ~ConstraintMask;
v84 = 9437184i64;
goto LABEL_109;
}
if( !ClientToken )
{
ClientToken = (_TOKEN *)v10->PrimaryToken;
InputToken = ClientToken;
}
v29 = *(_QWORD *)(a3 + 8);
if( (*(_DWORD *)(v29 + 4) & 4) == 0 )
{
v30 = SepFilterCheck(*(_QWORD *)(v29 + 8), &v189, ClientToken, 0, (INT64)&CapeSecurityDescriptor.Data[2]);
ReturnSomeAccessDenied = 0i64;
**(_DWORD **)(a4 + 16) = v30;
v31 = *(int **)(a4 + 16);
if( *v31 < 0 )
goto LABEL_120;
v32 = CapeSecurityDescriptor.Data[2];
*v31 = (*(_DWORD *)(a3 + 16) & 0xFDFFFFFF) != (CapeSecurityDescriptor.Data[2] & *(_DWORD *)(a3 + 16) & 0xFDFFFFFF) ? 0xC0000022 : 0;
if( **(int **)(a4 + 16) < 0 )
{
SeLogAccessFailure(ClientToken, 0i64, 0i64, 0i64, *(_QWORD *)(*(_QWORD *)(a3 + 8) + 8i64));
if( !dl0 )
SeUnlockSubjectContext(v10);
v83 = v18 & v32;
OverWriteb = 0;
v84 = 10485760i64;
LABEL_109:
v85 = v83;
goto LABEL_111;
}
}
v33 = *(_QWORD *)(a3 + 8);
v34 = *(_DWORD *)(v33 + 4);
v35 = v34 & 1;
v186[4] = v34 & 1;
if( (v34 & 2) != 0 )
{
LOBYTE(v36) = 1;
if( (ClientToken->TokenFlags & 0x2000) != 0 )
{
v37 = 1;
goto LABEL_34;
}
}
else
{
LOBYTE(v36) = 0;
}
v37 = 0;
LABEL_34:
v186[5] = v37;
if( !SepAllowAccessUponLogoff && (ClientToken->TokenFlags & 0x20) == 0 )
{
LogonSession = ClientToken->LogonSession;
if( LogonSession )
{
if( (LogonSession->Flags & 0x20) != 0 )
{
**(_DWORD **)(a4 + 8) = 0;
**(_DWORD **)(a4 + 16) = -1073741790;
goto LABEL_120;
}
}
}
LOBYTE(v193) = 0;
if( !v37 )
{
GenericMapping = (_GENERIC_MAPPING *)&CapeSecurityDescriptor.Data[4];
LOBYTE(TrustCheckInfoa) = (_BYTE)MandatoryInformation;
**(_DWORD **)(a4 + 16) = SepMandatoryIntegrityCheck(
*(_GENERIC_MAPPING **)(a3 + 32),
*(_SECURITY_DESCRIPTOR **)(v33 + 8),
(UINT8)v36,
ClientToken,
0,
(_SEP_MANDATORY_INFORMATION *)TrustCheckInfoa);
if( **(int **)(a4 + 16) >= 0 )
{
v38 = SepMandatoryToDiscretionary(
(_SEP_MANDATORY_INFORMATION *)&CapeSecurityDescriptor.Data[4],
*(unsigned int *)(a3 + 16));
*v36 = v38;
if( **(_DWORD **)(a4 + 16) >= (int)ReturnSomeAccessDenied )
{
if( (*(_DWORD *)(a3 + 16) & 0x2000000) != 0 && (ClientToken->TokenFlags & 0x4000) != 0 )
{
v87 = (unsigned __int8)v193;
if( CapeSecurityDescriptor.Data[7] <= 0x2000 )
v87 = 1;
v193 = v87;
}
goto LABEL_40;
}
if( (ClientToken->TokenFlags & 0x4000) != 0 && CapeSecurityDescriptor.Data[7] <= 0x2000 )
{
LOBYTE(v193) = 1;
goto LABEL_40;
}
if( dl0 == (_BYTE)ReturnSomeAccessDenied )
{
SeUnlockSubjectContext(v10);
LOBYTE(ReturnSomeAccessDenied) = 0;
}
v84 = 3145728i64;
OverWriteb = (unsigned __int8)ReturnSomeAccessDenied;
v85 = v18 & ~CapeSecurityDescriptor.Data[4];
LABEL_111:
AuthzBasepSetAccessReasons(v85, v84, 0i64, *(_ACCESS_REASONS **)(a4 + 24), OverWriteb);
return 0;
}
LABEL_120:
v80 = dl0 == 0;
LABEL_121:
if( v80 )
SeUnlockSubjectContext(v10);
return 0;
}
LABEL_40:
if( !SepRmEnforceCap )
goto LABEL_41;
v88 = *(_QWORD *)(*(_QWORD *)(a3 + 8) + 8i64);
v89 = *(_WORD *)(v88 + 2);
if( (v89 & 0x10) == 0 || KeGetCurrentIrql() >= 2u )
goto LABEL_41;
if( v89 >= 0 )
{
v91 = *(_ACL **)(v88 + 24);
}
else
{
v90 = *(unsigned int *)(v88 + 12);
if( !(_DWORD)v90 )
{
*(_QWORD *)&v199[4] = ReturnSomeAccessDenied;
goto LABEL_41;
}
v91 = (_ACL *)(v88 + v90);
}
*(_QWORD *)&v199[4] = v91;
if( v91 )
{
ScopedPolicySid = SepGetScopedPolicySid(v91);
ReturnSomeAccessDenied = 0i64;
if( ScopedPolicySid )
{
Cap = SepRmReferenceFindCap(ScopedPolicySid, (_SEP_CENTRALIZED_ACCESS_POLICY **)&a2);
v94 = a2;
ReturnSomeAccessDenied = 0i64;
v95 = Cap < 0;
v39 = 1;
v183 = 1;
if( v95 )
v94 = (_RTL_DYNAMIC_HASH_TABLE_ENTRY *)SepRmDefaultCap;
a2 = v94;
}
else
{
v39 = 0;
}
goto LABEL_42;
}
LABEL_41:
v39 = 0;
LABEL_42:
if( !v35 || (v41 = *(_DWORD *)(a3 + 16), (v41 & 0x2060000) != 0) || v39 )
{
IsOwner = SepTokenIsOwner(ClientToken, *(VOID **)(*(_QWORD *)(a3 + 8) + 8i64), (UINT8)v36);
v41 = *(_DWORD *)(a3 + 16);
ReturnSomeAccessDenied = 0i64;
}
else
{
IsOwner = (unsigned __int8)ReturnSomeAccessDenied;
}
v186[0] = IsOwner;
v42 = v41;
if( !IsOwner || (v41 & 0x2060000) == 0 )
goto LABEL_45;
v65 = v186[4];
if( v186[4] )
goto LABEL_149;
v66 = *(_QWORD *)(*(_QWORD *)(a3 + 8) + 8i64);
v67 = *(_WORD *)(v66 + 2);
if( (v67 & 4) == 0 )
goto LABEL_147;
if( v67 >= 0 )
{
v69 = *(_ACL **)(v66 + 32);
goto LABEL_80;
}
v68 = *(unsigned int *)(v66 + 16);
if( (_DWORD)v68 )
v69 = (_ACL *)(v66 + v68);
else
LABEL_147:
v69 = (_ACL *)ReturnSomeAccessDenied;
LABEL_80:
v70 = RtlpOwnerAcesPresent(0, v69);
ReturnSomeAccessDenied = 0i64;
if( !v70 )
goto LABEL_81;
v65 = 0;
LABEL_149:
v42 = v41;
if( !v65 )
{
LABEL_45:
v43 = v183;
goto LABEL_46;
}
LABEL_81:
v71 = 393216i64;
v72 = *(_DWORD *)(a3 + 16);
v73 = v72 & 0x60000;
v41 = 393216;
v74 = v72 & 0x2000000;
if( !v74 )
v41 = v73;
v75 = v18 & 0x60000;
*(_DWORD *)(a3 + 20) |= v41;
if( !v74 )
v71 = v75;
AuthzBasepSetAccessReasons(v71, 0x400000ui64, 0i64, *(_ACCESS_REASONS **)(a4 + 24), (UINT8)ReturnSomeAccessDenied);
ReturnSomeAccessDenied = 0i64;
v43 = v183;
v42 = *(_DWORD *)(a3 + 16) & 0xFFF9FFFF;
*(_DWORD *)(a3 + 16) = v42;
if( !v183 )
{
v186[0] = 0;
goto LABEL_47;
}
LABEL_46:
v44 = v186[0];
LABEL_47:
if( !v42 && !v43 && ((ClientToken->TokenFlags & 0x2000) != 0 || !v41) )
{
if( dl0 == (_BYTE)ReturnSomeAccessDenied )
{
SeUnlockSubjectContext(v10);
LODWORD(ReturnSomeAccessDenied) = 0;
}
**(_DWORD **)(a4 + 8) = *(_DWORD *)(a3 + 20);
**(_DWORD **)(a4 + 16) = (_DWORD)ReturnSomeAccessDenied;
return v16;
}
v45 = *(_QWORD *)(a3 + 8);
v46 = (_TOKEN *)v10->ClientToken;
PackageCapabilityInfo = v44;
PrimaryToken = (_TOKEN *)v10->PrimaryToken;
TokenIsOwner = *(_ACCESS_REASONS **)(a4 + 24);
AccessReason = *(_ACCESS_REASONS **)(a4 + 16);
AccessStatus = *(PRIVILEGE_SET ***)(a4 + 32);
Privileges = *(_PRIVILEGE_SET ***)(a4 + 8);
LODWORD(PreviousMode) = *(_DWORD *)(a3 + 20);
PreviouslyGrantedAccess = *(_GENERIC_MAPPING **)(a3 + 32);
LODWORD(GenericMapping) = (_DWORD)ReturnSomeAccessDenied;
LODWORD(OverWrite) = v42;
*(_OWORD *)&v202.PackageGrantedAccess = 0i64;
v203 = ReturnSomeAccessDenied;
v202.Remaining = v41;
v48 = SepAccessCheckEx(
*(VOID **)(v45 + 8),
0i64,
PrimaryToken,
v46,
OverWrite,
ReturnSomeAccessDenied,
GenericMapping,
PreviouslyGrantedAccess,
PreviousMode,
a6,
(UINT64 *)Privileges,
AccessStatus,
(INT64 *)AccessReason,
TokenIsOwner,
(UINT8)ReturnSomeAccessDenied,
PackageCapabilityInfo,
(UINT8)a7,
&v202,
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)&v189,
&v185,
(UINT8 *)ReturnSomeAccessDenied);
v49 = a2;
v186[4] = v48;
if( !SepRmEnforceCap || (v198 = **(_DWORD **)(a4 + 16), (v198 & 0x80000000) != 0) || !v183 )
{
LABEL_49:
if( v186[5] || (v50 = *(unsigned int *)(a3 + 16), (v50 & 0x2000000) == 0) )
{
if( (_BYTE)v193 && !*(_WORD *)((char *)&v203 + 1) )
{
**(_DWORD **)(a4 + 16) = -1073741790;
**(_DWORD **)(a4 + 8) = 0;
v158 = *(_DWORD **)(a4 + 8);
v159 = *(_ACCESS_REASONS **)(a4 + 24);
v185 = 0;
AuthzBasepSetAccessReasons((unsigned int)~*v158, 0x300000ui64, 0i64, v159, 0);
}
}
else
{
v51 = *(UINT64 **)(a4 + 8);
v52 = *(_DWORD *)v51;
if( !(_BYTE)v193 || !*(_WORD *)((char *)&v203 + 1) )
{
LODWORD(TrustCheckInfob) = 0;
SepConstrainByMandatory(
(_SEP_MANDATORY_INFORMATION *)&CapeSecurityDescriptor.Data[4],
v50,
v51,
*(INT64 **)(a4 + 16),
&v185,
(UINT64)TrustCheckInfob);
AuthzBasepSetAccessReasons(
v52 & (unsigned int)~**(_DWORD **)(a4 + 8),
0x300000ui64,
0i64,
*(_ACCESS_REASONS **)(a4 + 24),
0);
}
}
if( (*(_DWORD *)(a3 + 16) & 0x2000000) != 0 )
{
v53 = *(unsigned int **)(a4 + 8);
v54 = *(_DWORD **)(a4 + 16);
v55 = *v53;
if( v196.ConstraintMask == -1 || (v160 = v196.ConstraintMask & v55, (v196.ConstraintMask & v55) == v55) )
{
v56 = 0;
}
else
{
*v53 = v160;
v56 = 1;
if( v160 )
{
*v54 = 0;
v185 = 1;
}
else
{
*v54 = -1073741790;
v185 = 0;
}
}
AuthzBasepSetAccessReasons(v55 & ~**(_DWORD **)(a4 + 8), 0x900000ui64, 0i64, *(_ACCESS_REASONS **)(a4 + 24), 0);
v57 = *(unsigned int **)(a4 + 8);
v58 = *(_DWORD **)(a4 + 16);
v59 = *(_DWORD *)(a3 + 16);
v186[3] = 0;
v60 = *v57;
if( CapeSecurityDescriptor.Data[2] == -1
|| (v161 = v60 & CapeSecurityDescriptor.Data[2], (v60 & CapeSecurityDescriptor.Data[2]) == v60) )
{
v61 = v186[3];
}
else
{
*v57 = v161;
v61 = 1;
if( (v59 & 0x2000000) != 0 )
{
*v58 = v161 == 0 ? 0xC0000022 : 0;
v185 = v161 != 0;
}
else
{
*v58 = -1073741790;
v185 = *v57 != 0;
}
}
AuthzBasepSetAccessReasons(v60 & ~**(_DWORD **)(a4 + 8), 0xA00000ui64, 0i64, *(_ACCESS_REASONS **)(a4 + 24), 0);
}
else
{
v56 = v186[2];
v61 = v186[2];
}
v62 = InputToken;
if( InputToken )
{
if( v56
|| v61
|| (UserGroupsRemaining = v202.UserGroupsRemaining) == 0
&& (*((_DWORD *)InputToken + 50) & 0x4000) != 0
&& (**(int **)(a4 + 16) < 0 || BYTE3(v203)) )
{
v162 = *(_QWORD *)(a3 + 8);
v163 = SepLocateTokenTrustLevel(v10);
SeLogAccessFailure(InputToken, 0i64, 0i64, (UINT64)v163, *(_QWORD *)(v162 + 8));
UserGroupsRemaining = v202.UserGroupsRemaining;
v62 = InputToken;
}
if( **(int **)(a4 + 16) < 0
&& !UserGroupsRemaining
&& (v62[50] & 0x4000) != 0
&& SepLpacCausedAccessFailure((INT64)&v202, *(unsigned int *)(a3 + 16)) )
{
SepLogLpacAccessFailure();
}
}
if( v183 )
{
Blink = a2[1].Linkage.Blink;
if( Blink )
SepRmDereferenceCapTable((_SEP_CENTRALIZED_ACCESS_POLICIES_TABLE *)Blink);
}
if( !dl0 )
SeUnlockSubjectContext(v10);
SepFreeResourceInfo((VOID *)v189);
if( !v185 || !v186[4] )
return 0;
return v16;
}
v96 = *(unsigned int **)(a4 + 8);
v97 = 0i64;
LOBYTE(v190) = 0;
v98 = 0;
v191 = 0;
v99 = *v96;
v100 = *(unsigned int ***)(a4 + 32);
HIDWORD(Result) = v99;
HIDWORD(v192) = v99;
if( v100 )
{
v101 = *v100;
if( v101 )
{
v102 = *v101;
if( *v101 )
{
v103 = v101 + 3;
v104 = v102;
do
{
if( (int)v103[1] < 0 )
{
if( *(v103 - 1) == SeSecurityPrivilege.LowPart && *v103 == SeSecurityPrivilege.HighPart )
{
v98 |= 0x1000000u;
}
else if( *(_QWORD *)(v103 - 1) == SeTakeOwnershipPrivilege || *(_QWORD *)(v103 - 1) == SeRelabelPrivilege )
{
v98 |= 0x80000u;
}
}
v103 += 3;
--v104;
}
while( v104 );
v191 = v98;
}
}
}
v187 = v99;
v186[1] = SepAdtAuditThisEventWithContext(0x81ui64, 1u, 1u, v10);
v105 = v186[1];
if( v186[1] )
{
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 8i64 * HIDWORD(v49[2].Linkage.Blink), 1095984467i64);
v97 = PoolWithTag;
if( !PoolWithTag )
{
if( !dl0 )
SeUnlockSubjectContext(v10);
v107 = (_SEP_CENTRALIZED_ACCESS_POLICIES_TABLE *)v49[1].Linkage.Blink;
if( v107 )
SepRmDereferenceCapTable(v107);
**(_DWORD **)(a4 + 8) = 0;
**(_DWORD **)(a4 + 16) = -1073741801;
SepFreeResourceInfo((VOID *)v189);
return 0;
}
memset(PoolWithTag, 0i64, 8 * HIDWORD(v49[2].Linkage.Blink));
v105 = v186[1];
}
Blink_high = HIDWORD(v49[2].Linkage.Blink);
v109 = 0;
LODWORD(Data) = 0;
LODWORD(v197) = Blink_high;
if( !Blink_high )
{
LABEL_241:
if( v105 )
{
if( HIDWORD(v192) != HIDWORD(Result) )
{
v145 = HIDWORD(v192) & (HIDWORD(Result) ^ HIDWORD(v192));
v146 = HIDWORD(Result) & (HIDWORD(Result) ^ HIDWORD(v192));
v147 = 0;
v187 = v146;
v190 = 0;
if( Blink_high )
{
v148 = v97;
do
{
if( !v145 && !v146 )
break;
if( *((_BYTE *)v148 + 4) )
{
v149 = *(_DWORD *)v148;
v150 = v147 << 24;
v151 = v146 ^ *(_DWORD *)v148;
LODWORD(Data) = *(_DWORD *)v148;
v152 = v146 & v151;
if( v152 )
{
AuthzBasepSetAccessReasons(v152, 0x80000000ui64, v150, &SourceReasons, 0);
v149 = Data;
v146 = v187;
}
v153 = v145 & v149;
v187 = ~v152 & v146;
LODWORD(Data) = v153;
if( v153 )
{
AuthzBasepSetAccessReasons(v153, 0x80000000ui64, v150, &SourceReasons, 0);
v153 = Data;
}
v145 &= ~v153;
AuthzBasepMergeAccessReasons(&Reasons, &SourceReasons, 0xFF000000ui64);
v146 = v187;
v147 = v190;
Blink_high = v197;
}
++v147;
++v148;
v190 = v147;
}
while( v147 < Blink_high );
v10 = *(_SECURITY_SUBJECT_CONTEXT **)&CapeSecurityDescriptor.Data[10];
}
}
}
if( v97 )
ExFreePoolWithTag(v97, 0);
**(_DWORD **)(a4 + 16) = v198;
**(_DWORD **)(a4 + 8) &= HIDWORD(Result);
v154 = v185;
if( **(int **)(a4 + 16) < 0 )
v154 = 0;
v185 = v154;
AuthzBasepMergeAccessReasons(*(_ACCESS_REASONS **)(a4 + 24), &Reasons, 0i64);
AuthzBasepMergeAccessReasons(*(_ACCESS_REASONS **)(a4 + 24), &Reasons, 0xFF000000ui64);
goto LABEL_49;
}
while( 1 )
{
*(_OWORD *)ObjectTypeListLength = 0i64;
*(_QWORD *)&CapeSecurityDescriptor.Data[8] = v109;
v205 = 0i64;
v206 = 0i64;
v197 = *(&v49[2].Signature + v109);
if( !*(_QWORD *)(v197 + 24) )
goto LABEL_217;
v110 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v189;
if( !v189 )
{
v111 = AuthzBasepInitializeResourceClaimsFromSacl(
*(_ACL **)&v199[4],
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)&v189);
v110 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v189;
v112 = (unsigned __int8)v190;
if( v111 < 0 )
v112 = 1;
v190 = v112;
}
pClaimAttributes = ClientToken->pClaimAttributes;
v114 = pClaimAttributes ? pClaimAttributes->pRestrictedDeviceSecurityAttributes : 0i64;
v115 = pClaimAttributes ? pClaimAttributes->pDeviceSecurityAttributes : 0i64;
v116 = pClaimAttributes ? pClaimAttributes->pRestrictedUserSecurityAttributes : 0i64;
v117 = pClaimAttributes ? pClaimAttributes->pUserSecurityAttributes : 0i64;
LODWORD(PreviousModea) = *(_DWORD *)(v197 + 16);
v118 = AuthzBasepEvaluateAceCondition(
ClientToken,
ClientToken->pSecurityAttributes,
v110,
v117,
v116,
v115,
v114,
*(UINT8 **)(v197 + 24),
PreviousModea,
1u,
0,
&Result);
v119 = Result;
v120 = v118;
if( (_DWORD)Result == 1 )
goto LABEL_217;
if( v118 < 0 )
goto LABEL_260;
if( (ClientToken->TokenFlags & 0x10) != 0 )
break;
LABEL_215:
if( !(_BYTE)v190 && v119 != 1 )
goto LABEL_239;
LABEL_217:
v120 = SepBuildCapeSecurityDescriptor(&CapeSecurityDescriptor.Data[12], *(PVOID *)(v197 + 32), *(_ACL **)&v199[4]);
if( v120 < 0 )
{
if( !dl0 )
SeUnlockSubjectContext(v10);
v157 = a2[1].Linkage.Blink;
if( v157 )
SepRmDereferenceCapTable((_SEP_CENTRALIZED_ACCESS_POLICIES_TABLE *)v157);
**(_DWORD **)(a4 + 8) = 0;
goto LABEL_271;
}
v126 = *(_DWORD *)(a3 + 16);
if( (*(_DWORD *)(v197 + 48) & 1) != 0 )
{
if( (v126 & 0x2000000) == 0 )
v126 |= *(_DWORD *)(a3 + 20);
v127 = 0;
}
else
{
v127 = *(_DWORD *)(a3 + 20);
}
v128 = (_TOKEN *)v10->ClientToken;
v129 = (_TOKEN *)v10->PrimaryToken;
LODWORD(PreviousModea) = v127;
PreviouslyGrantedAccessa = *(_GENERIC_MAPPING **)(a3 + 32);
LODWORD(GenericMappinga) = 1;
LODWORD(OverWritea) = v126 | 0x2000000;
*(_OWORD *)ObjectTypeListLength = 0i64;
v205 = 0i64;
v206 = 0i64;
v130 = SepAccessCheckEx(
&CapeSecurityDescriptor.Data[12],
0i64,
v129,
v128,
OverWritea,
(_IOBJECT_TYPE_LIST *)ObjectTypeListLength,
GenericMappinga,
PreviouslyGrantedAccessa,
PreviousModea,
a6,
&v192,
0i64,
(INT64 *)&CapeSecurityDescriptor,
&v209,
0,
v186[0],
(UINT8)a7,
&v202,
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)&v189,
&v185,
0i64);
v131 = v191;
v186[4] = v130;
v132 = v192 & (v127 | **(_DWORD **)(a4 + 8));
v133 = v191 | HIDWORD(v205);
LODWORD(v192) = v132;
if( v186[0] )
v133 |= v132 & 0x60000;
v134 = ~(_DWORD)v206 & v133;
v135 = CapeSecurityDescriptor.Data[0];
HIDWORD(Result) &= v132;
if( !HIDWORD(Result) )
v135 = -1073741790;
v198 = v135;
if( (v187 & (v187 ^ v134)) != 0 )
{
AuthzBasepSetAccessReasons(v187 & (v187 ^ v134), 0x50000ui64, (unsigned int)Data, &Reasons, 0);
v187 &= v134;
v131 = v191;
}
v105 = v186[1];
if( v186[1] )
{
v136 = *(void **)(v197 + 40);
if( v136 )
{
v120 = SepBuildCapeSecurityDescriptor(&CapeSecurityDescriptor.Data[22], v136, *(_ACL **)&v199[4]);
if( v120 < 0 )
{
if( !dl0 )
SeUnlockSubjectContext(v10);
v156 = a2[1].Linkage.Blink;
if( v156 )
SepRmDereferenceCapTable((_SEP_CENTRALIZED_ACCESS_POLICIES_TABLE *)v156);
**(_DWORD **)(a4 + 8) = 0;
goto LABEL_271;
}
v137 = *(_DWORD *)(a3 + 16);
if( (*(_DWORD *)(v197 + 48) & 0x100) != 0 )
{
if( (v137 & 0x2000000) == 0 )
v137 |= *(_DWORD *)(a3 + 20);
v138 = 0;
}
else
{
v138 = *(_DWORD *)(a3 + 20);
}
v139 = (_TOKEN *)v10->ClientToken;
LODWORD(PreviousModea) = v138;
PreviouslyGrantedAccessb = *(_GENERIC_MAPPING **)(a3 + 32);
LODWORD(GenericMappinga) = 0;
v140 = (_TOKEN *)v10->PrimaryToken;
LODWORD(OverWritea) = v137;
*(_OWORD *)ObjectTypeListLength = 0i64;
v205 = 0i64;
v206 = 0i64;
SepAccessCheckEx(
&CapeSecurityDescriptor.Data[22],
0i64,
v140,
v139,
OverWritea,
0i64,
GenericMappinga,
PreviouslyGrantedAccessb,
PreviousModea,
a6,
(UINT64 *)v199,
0i64,
(INT64 *)&CapeSecurityDescriptor.Data[1],
&v209,
0,
v186[0],
(UINT8)a7,
&v202,
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)&v189,
&v186[6],
0i64);
v141 = *(_QWORD *)&CapeSecurityDescriptor.Data[8];
v142 = HIDWORD(v192);
v143 = v191;
BYTE4(v97[*(_QWORD *)&CapeSecurityDescriptor.Data[8]]) = 1;
LODWORD(v97[v141]) = *(_DWORD *)v199 | v143;
HIDWORD(v192) = *(_DWORD *)v199 & v142;
}
else
{
v144 = *(_QWORD *)&CapeSecurityDescriptor.Data[8];
BYTE4(v97[*(_QWORD *)&CapeSecurityDescriptor.Data[8]]) = 1;
LODWORD(v97[v144]) = v192 | v131;
HIDWORD(v192) &= v192;
}
LABEL_239:
v105 = v186[1];
}
v49 = a2;
v109 = Data + 1;
LODWORD(Data) = v109;
Blink_high = HIDWORD(a2[2].Linkage.Blink);
LODWORD(v197) = Blink_high;
if( v109 >= Blink_high )
goto LABEL_241;
}
v121 = ClientToken->pClaimAttributes;
if( v121 )
pRestrictedDeviceSecurityAttributes = v121->pRestrictedDeviceSecurityAttributes;
else
pRestrictedDeviceSecurityAttributes = 0i64;
if( v121 )
pDeviceSecurityAttributes = v121->pDeviceSecurityAttributes;
else
pDeviceSecurityAttributes = 0i64;
if( v121 )
pRestrictedUserSecurityAttributes = v121->pRestrictedUserSecurityAttributes;
else
pRestrictedUserSecurityAttributes = 0i64;
if( v121 )
pUserSecurityAttributes = v121->pUserSecurityAttributes;
else
pUserSecurityAttributes = 0i64;
LODWORD(PreviousModea) = *(_DWORD *)(v197 + 16);
v120 = AuthzBasepEvaluateAceCondition(
ClientToken,
ClientToken->pSecurityAttributes,
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v189,
pUserSecurityAttributes,
pRestrictedUserSecurityAttributes,
pDeviceSecurityAttributes,
pRestrictedDeviceSecurityAttributes,
*(UINT8 **)(v197 + 24),
PreviousModea,
1u,
1u,
&Result);
if( v120 >= 0 )
{
v119 = Result;
goto LABEL_215;
}
LABEL_260:
if( !dl0 )
SeUnlockSubjectContext(v10);
v155 = a2[1].Linkage.Blink;
if( v155 )
SepRmDereferenceCapTable((_SEP_CENTRALIZED_ACCESS_POLICIES_TABLE *)v155);
**(_DWORD **)(a4 + 8) = 0;
LABEL_271:
**(_DWORD **)(a4 + 16) = v120;
SepFreeResourceInfo((VOID *)v189);
if( v97 )
ExFreePoolWithTag(v97, 0);
return 0;
}Referenced by:
SepCommonAccessCheckEx