SepCreateClaimAttributes

UINT8 __fastcall SepCreateClaimAttributes(
        _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION **ClaimAttributes,
        _TOKEN_SECURITY_ATTRIBUTES_INFORMATION *UserClaims,
        _TOKEN_SECURITY_ATTRIBUTES_INFORMATION *DeviceClaims,
        UINT64 DeviceGroupCount){
  unsigned int v4; 
  NTSTATUS v7; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v8; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v9; 
  _SID_AND_ATTRIBUTES *v10; 
  _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION *ClaimCollectionNoLists; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *SecurityAttributesList; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v14; 
  int v15; 
  VOID **PoolWithTag; 
  UINT64 CaptureBufferLength; 
  POOL_TYPE v18; 
  UINT8 v19; 
  char v20; 
  char v21; 
  _TOKEN_SECURITY_ATTRIBUTE_OPERATION pOperations; 
  UINT64 AlignedArraySize; 
  _SID_AND_ATTRIBUTES *CapturedArray; 
  _SID_AND_ATTRIBUTES *InputArray; 

  pOperations = TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL;
  v4 = DeviceGroupCount;
  v20 = 0;
  v21 = 0;
  LODWORD(AlignedArraySize) = 0;
  LOBYTE(v7) = 0;
  CapturedArray = 0i64;
  v8 = 0i64;
  v9 = 0i64;
  v10 = 0i64;
  if( !ClaimAttributes )
    return 13;
  *ClaimAttributes = 0i64;
  if( !UserClaims && !DeviceClaims && !(_DWORD)DeviceGroupCount )
    return 0;
  ClaimCollectionNoLists = AuthzBasepAllocateClaimCollectionNoLists();
  if( ClaimCollectionNoLists )
  {
    if( UserClaims )
    {
      SecurityAttributesList = AuthzBasepAllocateSecurityAttributesList();
      v8 = SecurityAttributesList;
      if( !SecurityAttributesList )
      {
        LOBYTE(v7) = -102;
LABEL_35:
        ExFreePoolWithTag(ClaimCollectionNoLists, 0);
        return v7;
      }
      v7 = AuthzBasepSetSecurityAttributesToken((_FADT *)SecurityAttributesList, &pOperations, UserClaims);
      if( v7 < 0 )
        goto LABEL_25;
      v20 = 1;
      ClaimCollectionNoLists->pUserSecurityAttributes = v8;
    }
    if( DeviceClaims )
    {
      v14 = AuthzBasepAllocateSecurityAttributesList();
      v9 = v14;
      if( !v14 )
        goto LABEL_37;
      v7 = AuthzBasepSetSecurityAttributesToken((_FADT *)v14, &pOperations, DeviceClaims);
      if( v7 < 0 )
        goto LABEL_25;
      v21 = 1;
      ClaimCollectionNoLists->pDeviceSecurityAttributes = v9;
    }
    if( !InputArray || !v4 )
      goto LABEL_24;
    v7 = SepLengthSidAndAttributesArray(InputArray, v4, &AlignedArraySize);
    if( v7 < 0 )
    {
LABEL_25:
      if( v8 )
      {
        if( v20 )
          AuthzBasepFreeSecurityAttributesList(v8);
        ExFreePoolWithTag(v8, 0);
      }
      if( v9 )
      {
        if( v21 )
          AuthzBasepFreeSecurityAttributesList(v9);
        ExFreePoolWithTag(v9, 0);
      }
      if( v10 )
        ExFreePoolWithTag(v10, 0);
      goto LABEL_35;
    }
    v15 = AlignedArraySize;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)AlignedArraySize, 1683252563i64);
    v10 = (_SID_AND_ATTRIBUTES *)PoolWithTag;
    if( PoolWithTag )
    {
      LODWORD(CaptureBufferLength) = v15;
      v7 = SeCaptureSidAndAttributesArray(
             InputArray,
             v4,
             0i64,
             PoolWithTag,
             CaptureBufferLength,
             v18,
             v19,
             &CapturedArray,
             &AlignedArraySize);
      if( v7 >= 0 )
      {
        ClaimCollectionNoLists->DeviceGroupsCount = v4;
        ClaimCollectionNoLists->pDeviceGroups = v10;
        RtlSidHashInitialize(v10, v4, &ClaimCollectionNoLists->DeviceGroupsHash);
LABEL_24:
        *ClaimAttributes = ClaimCollectionNoLists;
        return v7;
      }
      goto LABEL_25;
    }
LABEL_37:
    LOBYTE(v7) = -102;
    goto LABEL_25;
  }
  LOBYTE(v7) = -102;
  return v7;
}

Referenced by: